fix: address open source security vulnerabilities - #7069
Open
circleci-app[bot] wants to merge 2 commits into
Open
fix: address open source security vulnerabilities#7069circleci-app[bot] wants to merge 2 commits into
circleci-app[bot] wants to merge 2 commits into
Conversation
Points the prodsec orb at the dev build of snyk/prodsec-orb#166 so this repository can exercise the agentic Open Source fix before that PR is released, and switches it on for the code-analysis job. - prodsec orb: snyk/prodsec-orb@1 -> @dev:31a2fb2e92f1f80de62249143bd3a816b3836971 - open-source-scan: high -> medium - open-source-agentic-fix-enabled: true - prodsec-orb-runtime added to the code-analysis contexts, which is where LITELLM_API_KEY, LITELLM_BASE_URL, LITELLM_MODEL and REMY_GITHUB_TOKEN come from. Without it the feature skips, naming what is missing. When the Enhanced Gate blocks an Open Source scan the job still fails exactly as it does today, and in addition `snyk fix --agentic` runs at the same severity threshold the gate uses and raises a pull request against the branch that failed. The fix step always exits 0, so it cannot turn a passing build red or mask a failure. Worth knowing before this merges: - Lowering to medium is a real behavioural change on its own: the gate can now block on medium-severity findings that previously passed. This repository also sets open-source-block-ignore-sla, so the gate already ignores remediation SLA - the two together widen what blocks considerably. Both this repository's AI reviewer and the orb author flagged that the most likely first outcome is a blocked main pipeline, and that the fix may exceed its own safety caps (50 files / 5000 lines / 1MB patch) and refuse to push anything. Reverting this one line to high is a reasonable call if the trial should be informative rather than broad. - Enabling the feature adds a github-cli/install step that runs on every build of this repository, not only blocked ones, because a CircleCI step cannot be made conditional on a runtime value. If that install fails it fails the job even when the gate passed. - `snyk fix` runs this repository's dependency lifecycle scripts in the same job that holds the context secrets. The LLM key, the Snyk token and - since the orb now exports GH_TOKEN for the GitHub CLI - a repository-write GitHub token are all readable by those scripts. The dev orb reference is mutable and expires after 90 days, so this must move back to snyk/prodsec-orb@1 once #166 is released - otherwise the orb stops resolving and blocks every pull request. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Fixes 9 blocking issues identified by Snyk Open Source scan: - Upgrade tar ^7.5.8 → ^7.5.21 (fixes SNYK-JS-TAR-18319500) - Upgrade marked ^4.0.1 → ^4.0.10 (fixes SNYK-JS-MARKED-2342073, SNYK-JS-MARKED-2342082) - Upgrade snyk-nodejs-lockfile-parser 2.10.0 → 2.10.3 (removes @yarnpkg/core dependency, fixing SNYK-JS-DIFF-14917201, SNYK-JS-GOT-2932019, SNYK-JS-JSYAML-17342520) - Add overrides for yaml → 1.10.3 (fixes SNYK-JS-YAML-15765520) - Upgrade @sentry/node ^7.36.0 → ^7.75.0 in ts-binary-wrapper (fixes SNYK-JS-COOKIE-8163060) - Ignore SNYK-JS-INFLIGHT-6095116: no fix available without breaking glob/rimraf major upgrades AI-Generated: true
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
ShawkyZ
force-pushed
the
feat/AG-387-trial-agentic-fix
branch
8 times, most recently
from
August 7, 2026 15:14
ca97c4d to
5d057cc
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes 9 blocking issues identified by the Snyk Open Source scan (CI job 626519).
^7.5.8→^7.5.21— fixesSNYK-JS-TAR-18319500(Uncontrolled Recursion, resolved to7.5.22)^4.0.1→^4.0.10— fixesSNYK-JS-MARKED-2342073andSNYK-JS-MARKED-2342082(ReDoS, resolved to4.3.0)2.10.0→2.10.3— removes the@yarnpkg/coredependency chain, fixingSNYK-JS-DIFF-14917201(ReDoS in diff@5.2.0),SNYK-JS-GOT-2932019(Open Redirect in got@11.8.2), andSNYK-JS-JSYAML-17342520(Inefficient Complexity in js-yaml@3.15.0)1.10.3— fixesSNYK-JS-YAML-15765520(Uncontrolled Recursion in yaml@1.10.2) for transitive consumers via@open-policy-agent/opa-wasm,@snyk/cloud-config-parser, andsnyk-cpp-plugin^7.36.0→^7.75.0— fixesSNYK-JS-COOKIE-8163060(XSS in cookie@0.4.2, resolved to7.120.4)SNYK-JS-INFLIGHT-6095116): ignored in.snyk— no fix available without major-version breaking changes toglob/rimrafhttps://app.circleci.com/agents/gh/snyk/chat/ffef71dd-7fb1-46df-b5ca-56b98edcaaa9