fix(security): resolve new Trivy Repository Scan CVEs blocking CI - #528
Merged
Conversation
The Trivy vulnerability DB picked up new CVE IDs since the last scan, breaking CI (Security Scan Summary / Trivy Repository Scan) across unrelated open PRs (numbers 525, 526, 527) with no code changes needed on their part. - golang.org/x/crypto v0.48.0 -> v0.54.0: fixes CVE-2026-39827..39835, CVE-2026-42508, CVE-2026-46595/46597/46598 (indirect dep, no direct usage; go build/go test ./... verified green after bump). - vscode-extension: add "overrides" pin for brace-expansion@^5.0.8, fixing CVE-2026-13149 and CVE-2026-14257 (DoS via exponential-time brace expansion) across the multiple brace-expansion versions (1.1.12/2.0.2/5.0.4) pulled in transitively by eslint/glob/vsce/mocha. Verified npm run compile succeeds; pre-existing lint errors in test files are unrelated (present on main too). - .trivyignore: extend the existing docker/docker entry with 3 new CVE IDs for the same already-documented unfixed issue (v28.5.2 is still latest; testcontainers-go test-only dependency, not production code). Verified locally with the same trivy invocation CI uses (scan-type=fs, skip-dirs=website/node_modules,website, severity=CRITICAL,HIGH,MEDIUM, trivyignores=.trivyignore): before = 18 findings, after = 0 findings. Note: website/ is excluded from this Trivy job via skip-dirs, so its own brace-expansion transitive dependency is out of scope here.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Claude encountered an error —— View job I'll analyze this and get back to you. |
ajitpratap0
added a commit
that referenced
this pull request
Jul 31, 2026
# Conflicts: # .trivyignore
ajitpratap0
added a commit
that referenced
this pull request
Jul 31, 2026
ajitpratap0
added a commit
that referenced
this pull request
Jul 31, 2026
# Conflicts: # .trivyignore
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The Trivy vulnerability DB picked up new CVE IDs since these workflows were last green, which broke
Trivy Repository Scan/Security Scan SummaryCI on all currently open PRs (#525, #526, #527) even though none of them touch these dependencies. This is a pre-existing, repo-wide gate issue, not something fixable from within those PR branches.Root cause (verified with the exact
trivy-actioninvocation CI uses:scan-type=fs,skip-dirs=website/node_modules,website,severity=CRITICAL,HIGH,MEDIUM,trivyignores=.trivyignore)golang.org/x/cryptov0.48.0github.com/docker/dockerv28.5.2+incompatiblebrace-expansion(vscode-extension npm tree, versions 1.1.12/2.0.2/5.0.4)Changes
go.mod/go.sum: bumpgolang.org/x/crypto(indirect) to v0.54.0 viago get -u golang.org/x/crypto@latest && go mod tidy. Not used directly by GoSQLX code.go build ./...andgo test ./...pass (full suite, all green).vscode-extension/package.json: add an"overrides"entry pinningbrace-expansionto^5.0.8, which dedupes the 3 vulnerable versions pulled in transitively byeslint/glob/@vscode/vsce/mocha.npm run compilesucceeds. The 12 pre-existing lint errors in test files are unrelated to this change (present onmaintoo, confirmed against a clean checkout)..trivyignore: extend the existing documenteddocker/dockerignore entry with the 3 new CVE IDs for the same already-accepted "no fixed version available, test-only dependency via testcontainers-go" issue — consistent with the existing pattern in this file, not a blanket suppression.Verification
Ran
trivy fslocally with the identical flags from.github/workflows/security.ymlbefore/after this change to confirm.Also ran:
go build ./...✅go test ./...✅ (full suite green)npm run compile(vscode-extension) ✅npm run build(website, unaffected — excluded from this scan job viaskip-dirs, no changes made there)Note
website/is excluded from the Trivy Repository Scan job viaskip-dirs, so its own separatebrace-expansiontransitive dependency is out of scope for this fix.