From a0b2832300676573bace5bbd6dce6671ccf9bb0d Mon Sep 17 00:00:00 2001 From: yuneng-jiang Date: Fri, 23 Jan 2026 11:03:18 -0800 Subject: [PATCH] fixing security checks --- ci_cd/security_scans.sh | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/ci_cd/security_scans.sh b/ci_cd/security_scans.sh index 04f3e27a94..af84a7d063 100755 --- a/ci_cd/security_scans.sh +++ b/ci_cd/security_scans.sh @@ -138,6 +138,19 @@ run_grype_scans() { "CVE-2026-22184" # zlib untgz buffer overflow - untgz unused + no fixed Wolfi build yet "GHSA-58pv-8j8x-9vj2" # jaraco.context path traversal - setuptools vendored only (v5.3.0), not used in application code (using v6.1.0+) "GHSA-r6q2-hw4h-h46w" # node-tar not used by application runtime, Linux-only container, not affect by macOS APFS-specific exploit + "GHSA-8rrh-rw8j-w5fx" # wheel is from chainguard and will be handled by then TODO: Remove this after Chainguard updates the wheel + "CVE-2025-59465" # We do not use Node in application runtime, only used for building Admin UI + "CVE-2025-55131" # We do not use Node in application runtime, only used for building Admin UI + "CVE-2025-59466" # We do not use Node in application runtime, only used for building Admin UI + "CVE-2025-55130" # We do not use Node in application runtime, only used for building Admin UI + "CVE-2025-15281" # No fix available yet + "CVE-2026-0865" # No fix available yet + "CVE-2025-15282" # No fix available yet + "CVE-2026-0672" # No fix available yet + "CVE-2025-15366" # No fix available yet + "CVE-2025-15367" # No fix available yet + "CVE-2025-12781" # No fix available yet + "CVE-2025-11468" # No fix available yet ) # Build JSON array of allowlisted CVE IDs for jq