Skip to content

chore(deps): fix Grype Critical/High findings in transitive deps (shell-quote, qs, aiohttp, openssl)#601

Merged
katriendg merged 2 commits into
mainfrom
copilot/fix-grype-security-scan-issues
Jun 10, 2026
Merged

chore(deps): fix Grype Critical/High findings in transitive deps (shell-quote, qs, aiohttp, openssl)#601
katriendg merged 2 commits into
mainfrom
copilot/fix-grype-security-scan-issues

Conversation

Copilot AI commented Jun 10, 2026

Copy link
Copy Markdown
Contributor

Grype was failing PR validation on the Security Scan job due to a Critical shell-quote advisory (GHSA-w7jw-789q-3m8p) and several Medium findings in pre-existing transitive dependencies unrelated to any individual PR's changes.

npm — Docusaurus lockfile

Added overrides in docs/docusaurus/package.json to force fixed versions through transitive parent ranges:

"overrides": {
  "shell-quote": "^1.8.4",
  "qs": "^6.15.2"
}

Regenerated package-lock.json via npm install --package-lock-only.

Python — 510-onvif-connector services

Two services still pinned aiohttp==3.13.5 (others were already at 3.14.x):

  • onvif-camera-simulator/requirements.in: bumped floor from >=3.12.14>=3.14.0
  • camera-dashboard/requirements.in: added explicit aiohttp>=3.14.0 constraint (was only a transitive dep)

Both requirements.txt files recompiled with pip-compile --generate-hashes; resolved to 3.14.1.

Rust — three Cargo.lock files

Ran cargo update -p openssl in each affected service to move openssl 0.10.79 → 0.10.80 and openssl-sys 0.9.115 → 0.9.116:

  • 501-rust-telemetry/services/receiver
  • 502-rust-http-connector/services/subscriber
  • 504-mqtt-otel-trace-exporter/services/mqtt-otel-trace-exporter

No suppressions added to .grype.yaml.

…findings

- Add shell-quote@^1.8.4 and qs@^6.15.2 overrides to docs/docusaurus/package.json
- Update aiohttp 3.13.5→3.14.1 in onvif-connector camera-dashboard and onvif-camera-simulator
- Update openssl 0.10.79→0.10.80 in receiver, subscriber, and mqtt-otel-trace-exporter Cargo.lock files

🔒 - Generated by Copilot
Copilot AI changed the title [WIP] Fix Grype security scan failures blocking unrelated PRs chore(deps): fix Grype Critical/High findings in transitive deps (shell-quote, qs, aiohttp, openssl) Jun 10, 2026
Copilot AI requested a review from katriendg June 10, 2026 09:01

@katriendg katriendg left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@katriendg katriendg marked this pull request as ready for review June 10, 2026 09:28
@katriendg katriendg requested a review from a team as a code owner June 10, 2026 09:28
@codecov-commenter

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 32.09%. Comparing base (b648d67) to head (b67f5ab).

Additional details and impacted files

Impacted file tree graph

@@           Coverage Diff           @@
##             main     #601   +/-   ##
=======================================
  Coverage   32.09%   32.09%           
=======================================
  Files          40       40           
  Lines        5960     5960           
=======================================
  Hits         1913     1913           
  Misses       4047     4047           
Flag Coverage Δ
rust 32.09% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@katriendg katriendg merged commit c18c344 into main Jun 10, 2026
64 checks passed
@katriendg katriendg deleted the copilot/fix-grype-security-scan-issues branch June 10, 2026 12:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

chore(deps): grype security scan fails PR validation on pre-existing transitive vulnerabilities inc shell-quote

4 participants