Security: triage May 2026 code scanning alerts (#45740)
This commit is contained in:
Luke Heath
@@ -116,7 +116,7 @@ jobs:
|
||||
go-version-file: 'go.mod'
|
||||
|
||||
- name: Install gotestsum
|
||||
run: go install gotest.tools/gotestsum@latest
|
||||
run: go install gotest.tools/gotestsum@c4a0df2e75a225d979a444342dd3db752b53619f # v1.13.0
|
||||
|
||||
# Pre-starting dependencies here means they are ready to go when we need them.
|
||||
- name: Start Infra Dependencies
|
||||
|
||||
@@ -131,7 +131,7 @@ jobs:
|
||||
go-version-file: 'go.mod'
|
||||
|
||||
- name: Install gotestsum
|
||||
run: go install gotest.tools/gotestsum@latest
|
||||
run: go install gotest.tools/gotestsum@c4a0df2e75a225d979a444342dd3db752b53619f # v1.13.0
|
||||
|
||||
- name: verify mysql
|
||||
run: |
|
||||
|
||||
@@ -25,7 +25,7 @@ jobs:
|
||||
"runs": [{ "tool": { "driver": { "name": "Trivy" } }, "results": [] }]
|
||||
}
|
||||
EOF
|
||||
- uses: github/codeql-action/upload-sarif@v3
|
||||
- uses: github/codeql-action/upload-sarif@8a470fddafa5cbb6266ee11b37ef4d8aae19c571 # v3.24.6
|
||||
with:
|
||||
sarif_file: clean.sarif
|
||||
category: ${{ matrix.category }}
|
||||
|
||||
@@ -132,12 +132,14 @@ jobs:
|
||||
# - ee/orbit/pkg/httpsigproxy/httpsigproxy.go: TLS key only used for osquery to orbit _local_ communication
|
||||
# (for injection of HTTP signatures for the TPM-backed feature in Linux).
|
||||
# - website/config/custom.js: commented-out Stripe test-mode placeholders shown as example config.
|
||||
# - ee/fleet-agent-downloader/config/custom.js: same Sails template, commented-out Stripe test placeholders.
|
||||
skip-files: |
|
||||
tools/osquery/in-a-box/osquery/fleet.key
|
||||
tools/osquery/fleet.key
|
||||
orbit/pkg/insecure/proxy.go
|
||||
ee/orbit/pkg/httpsigproxy/httpsigproxy.go
|
||||
website/config/custom.js
|
||||
ee/fleet-agent-downloader/config/custom.js
|
||||
|
||||
- name: Upload Trivy scan results to GitHub Security tab
|
||||
# Only upload on schedule/manual runs. PR/push uploads register
|
||||
|
||||
+9
-8
@@ -36,7 +36,7 @@
|
||||
"lodash": "4.18.1",
|
||||
"memoize-one": "5.2.1",
|
||||
"normalizr": "3.6.2",
|
||||
"postcss": "^8.5.10",
|
||||
"postcss": "8.5.10",
|
||||
"prop-types": "15.8.1",
|
||||
"proxy-middleware": "0.15.0",
|
||||
"rc-pagination": "1.16.3",
|
||||
@@ -100,7 +100,7 @@
|
||||
"@testing-library/jest-dom": "6.4.2",
|
||||
"@testing-library/react": "15.0.2",
|
||||
"@testing-library/user-event": "14.5.2",
|
||||
"@tsconfig/recommended": "^1.0.13",
|
||||
"@tsconfig/recommended": "1.0.13",
|
||||
"@types/chrome": "0.0.237",
|
||||
"@types/classnames": "0.0.32",
|
||||
"@types/content-disposition": "0.5.4",
|
||||
@@ -171,19 +171,20 @@
|
||||
"storybook": "8.6.17",
|
||||
"trace-unhandled": "2.0.1",
|
||||
"ts-loader": "6.2.2",
|
||||
"typescript": "^6.0.2",
|
||||
"typescript": "6.0.2",
|
||||
"webpack": "5.105.0",
|
||||
"webpack-cli": "5.0.1",
|
||||
"webpack-notifier": "1.12.0"
|
||||
},
|
||||
"resolutions": {
|
||||
"**/css-node-extract": "~3.0.4",
|
||||
"**/css-node-extract/postcss": "^8.4.31",
|
||||
"**/css-selector-extract": "~4.0.1",
|
||||
"**/wait-on/axios": "^0.28.0",
|
||||
"**/css-node-extract": "3.0.4",
|
||||
"**/css-node-extract/postcss": "8.5.10",
|
||||
"**/css-selector-extract": "4.0.1",
|
||||
"**/wait-on/axios": "0.28.1",
|
||||
"@types/react": "18.3.12",
|
||||
"@types/react-dom": "18.2.0",
|
||||
"**/serialize-javascript": "^7.0.3"
|
||||
"**/serialize-javascript": "7.0.5",
|
||||
"**/yaml": "1.10.3"
|
||||
},
|
||||
"browserslist": [
|
||||
"defaults"
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
FROM debian:13.4
|
||||
FROM debian:13.4@sha256:e2d08da6f42ef4b09b165d55528a12727aeed8240dc9edf888e3ec07e10ef9da
|
||||
|
||||
COPY fleet-osquery_amd64.deb /
|
||||
COPY run-fleetd.sh /
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
FROM fedora:43
|
||||
FROM fedora:43@sha256:49b5f0ab05516b1a8168c79f295da65e8d8db1cae275a4bec007c0b88cd19ffb
|
||||
|
||||
COPY fleet-osquery_amd64.rpm /
|
||||
COPY run-fleetd.sh /
|
||||
|
||||
@@ -2776,7 +2776,7 @@
|
||||
resolved "https://registry.npmjs.org/@testing-library/user-event/-/user-event-14.5.2.tgz"
|
||||
integrity sha512-YAh82Wh4TIrxYLmfGcixwD18oIjyC1pFQC2Y01F2lzV2HTMiYrI0nze0FD0ocB//CKS/7jIUgae+adPqxK5yCQ==
|
||||
|
||||
"@tsconfig/recommended@^1.0.13":
|
||||
"@tsconfig/recommended@1.0.13":
|
||||
version "1.0.13"
|
||||
resolved "https://registry.yarnpkg.com/@tsconfig/recommended/-/recommended-1.0.13.tgz#269fce3ad04ca70b93269ff44cca81b950f542da"
|
||||
integrity sha512-sySRuBfMKyKO/j2ZAhR8kSembhjuPEV4Ra3AHtmWLq51+iGaudr45crPSzNC5b7/Ctrh9dfUpBuTlYrH6rM58Q==
|
||||
@@ -3859,6 +3859,15 @@ axe-core@^4.2.0:
|
||||
resolved "https://registry.npmjs.org/axe-core/-/axe-core-4.11.1.tgz"
|
||||
integrity sha512-BASOg+YwO2C+346x3LZOeoovTIoTrRqEsqMa6fmfAV0P+U9mFr9NsyOEpiYvFjbc64NMrSswhV50WdXzdb/Z5A==
|
||||
|
||||
axios@0.28.1, axios@^1.6.1:
|
||||
version "0.28.1"
|
||||
resolved "https://registry.yarnpkg.com/axios/-/axios-0.28.1.tgz#2a7bcd34a3837b71ee1a5ca3762214b86b703e70"
|
||||
integrity sha512-iUcGA5a7p0mVb4Gm/sy+FSECNkPFT4y7wt6OM/CDpO/OnNCvSs3PoMG8ibrC9jRoGYU0gUK5pXVC4NPXq6lHRQ==
|
||||
dependencies:
|
||||
follow-redirects "^1.15.0"
|
||||
form-data "^4.0.0"
|
||||
proxy-from-env "^1.1.0"
|
||||
|
||||
axios@1.15.2:
|
||||
version "1.15.2"
|
||||
resolved "https://registry.yarnpkg.com/axios/-/axios-1.15.2.tgz#eb8fb6d30349abace6ade5b4cb4d9e8a0dc23e5b"
|
||||
@@ -3868,15 +3877,6 @@ axios@1.15.2:
|
||||
form-data "^4.0.5"
|
||||
proxy-from-env "^2.1.0"
|
||||
|
||||
axios@^0.28.0, axios@^1.6.1:
|
||||
version "0.28.1"
|
||||
resolved "https://registry.yarnpkg.com/axios/-/axios-0.28.1.tgz#2a7bcd34a3837b71ee1a5ca3762214b86b703e70"
|
||||
integrity sha512-iUcGA5a7p0mVb4Gm/sy+FSECNkPFT4y7wt6OM/CDpO/OnNCvSs3PoMG8ibrC9jRoGYU0gUK5pXVC4NPXq6lHRQ==
|
||||
dependencies:
|
||||
follow-redirects "^1.15.0"
|
||||
form-data "^4.0.0"
|
||||
proxy-from-env "^1.1.0"
|
||||
|
||||
axobject-query@^0.1.0:
|
||||
version "0.1.0"
|
||||
resolved "https://registry.npmjs.org/axobject-query/-/axobject-query-0.1.0.tgz"
|
||||
@@ -4826,7 +4826,7 @@ css-loader@^6.7.1:
|
||||
postcss-value-parser "^4.2.0"
|
||||
semver "^7.5.4"
|
||||
|
||||
css-node-extract@^2.1.3, css-node-extract@~3.0.4:
|
||||
css-node-extract@3.0.4, css-node-extract@^2.1.3:
|
||||
version "3.0.4"
|
||||
resolved "https://registry.yarnpkg.com/css-node-extract/-/css-node-extract-3.0.4.tgz#896e454cf1626662fb373046d2464c90c340f842"
|
||||
integrity sha512-y0IUmFXrKOMkJNZHtvU9aKXrMUP6q60TB75S0FRqywovIxNl9i8spVsmpsMJ7uwbYn+0VmRp8aPRwcB1XRbo4g==
|
||||
@@ -4845,7 +4845,7 @@ css-select@^4.1.3:
|
||||
domutils "^2.8.0"
|
||||
nth-check "^2.0.1"
|
||||
|
||||
css-selector-extract@^3.3.6, css-selector-extract@~4.0.1:
|
||||
css-selector-extract@4.0.1, css-selector-extract@^3.3.6:
|
||||
version "4.0.1"
|
||||
resolved "https://registry.yarnpkg.com/css-selector-extract/-/css-selector-extract-4.0.1.tgz#71f62916435764cd5eb338bdd962f6fef01b8795"
|
||||
integrity sha512-Ee2PJUE0Ma9NqCZ5AauYIsKZJA8Ni81XIbwoypv3Iid4MAPfRmjYBLxpRWsAi10D/iPIWZ5DIRGJ8dj/mRGsCQ==
|
||||
@@ -9675,7 +9675,7 @@ postcss-value-parser@^4.1.0, postcss-value-parser@^4.2.0:
|
||||
resolved "https://registry.npmjs.org/postcss-value-parser/-/postcss-value-parser-4.2.0.tgz"
|
||||
integrity sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==
|
||||
|
||||
postcss@^7.0.36, postcss@^8.2.13, postcss@^8.2.7, postcss@^8.4.19, postcss@^8.4.31, postcss@^8.4.33, postcss@^8.5.10:
|
||||
postcss@8.5.10, postcss@^7.0.36, postcss@^8.2.13, postcss@^8.2.7, postcss@^8.4.19, postcss@^8.4.33:
|
||||
version "8.5.10"
|
||||
resolved "https://registry.yarnpkg.com/postcss/-/postcss-8.5.10.tgz#8992d8c30acf3f12169e7c09514a12fed7e48356"
|
||||
integrity sha512-pMMHxBOZKFU6HgAZ4eyGnwXF/EvPGGqUr0MnZ5+99485wwW41kW91A4LOGxSHhgugZmSChL5AlElNdwlNgcnLQ==
|
||||
@@ -10670,7 +10670,7 @@ sentence-case@^3.0.4:
|
||||
tslib "^2.0.3"
|
||||
upper-case-first "^2.0.2"
|
||||
|
||||
serialize-javascript@^6.0.2, serialize-javascript@^7.0.3:
|
||||
serialize-javascript@7.0.5, serialize-javascript@^6.0.2:
|
||||
version "7.0.5"
|
||||
resolved "https://registry.yarnpkg.com/serialize-javascript/-/serialize-javascript-7.0.5.tgz#c798cc0552ffbb08981914a42a8756e339d0d5b1"
|
||||
integrity sha512-F4LcB0UqUl1zErq+1nYEEzSHJnIwb3AF2XWB94b+afhrekOUijwooAYqFyRbjYkm2PAKBabx6oYv/xDxNi8IBw==
|
||||
@@ -11488,7 +11488,7 @@ typedarray-to-buffer@^3.1.5:
|
||||
dependencies:
|
||||
is-typedarray "^1.0.0"
|
||||
|
||||
typescript@^6.0.2:
|
||||
typescript@6.0.2:
|
||||
version "6.0.2"
|
||||
resolved "https://registry.yarnpkg.com/typescript/-/typescript-6.0.2.tgz#0b1bfb15f68c64b97032f3d78abbf98bdbba501f"
|
||||
integrity sha512-bGdAIrZ0wiGDo5l8c++HWtbaNCWTS4UTv7RaTH/ThVIgjkveJt83m74bBHMJkuCbslY8ixgLBVZJIOiQlQTjfQ==
|
||||
@@ -12207,10 +12207,10 @@ yallist@^3.0.2:
|
||||
resolved "https://registry.npmjs.org/yallist/-/yallist-3.1.1.tgz"
|
||||
integrity sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==
|
||||
|
||||
yaml@^1.10.0:
|
||||
version "1.10.2"
|
||||
resolved "https://registry.npmjs.org/yaml/-/yaml-1.10.2.tgz"
|
||||
integrity sha512-r3vXyErRCYJ7wg28yvBY5VSoAF8ZvlcW9/BwUzEtUsjvX/DKs24dIkuwjtuprwJJHsbyUbLApepYTR1BN4uHrg==
|
||||
yaml@1.10.3, yaml@^1.10.0:
|
||||
version "1.10.3"
|
||||
resolved "https://registry.yarnpkg.com/yaml/-/yaml-1.10.3.tgz#76e407ed95c42684fb8e14641e5de62fe65bbcb3"
|
||||
integrity sha512-vIYeF1u3CjlhAFekPPAk2h/Kv4T3mAkMox5OymRiJQB0spDP10LHvt+K7G9Ny6NuuMAb25/6n1qyUjAcGNf/AA==
|
||||
|
||||
yargs-parser@^18.1.2:
|
||||
version "18.1.3"
|
||||
|
||||
Reference in New Issue
Block a user