From c0f5e520d3a70de4afa05d66d5bd22052faaa22f Mon Sep 17 00:00:00 2001 From: Luke Heath Date: Wed, 20 May 2026 09:12:34 -0500 Subject: [PATCH] Security: triage May 2026 code scanning alerts (#45740) --- .github/workflows/test-go-suite.yaml | 2 +- .github/workflows/test-go.yaml | 2 +- .github/workflows/trivy-close-legacy.yml | 2 +- .github/workflows/trivy-scan.yml | 2 ++ package.json | 17 +++++----- tools/fleetd-linux/debian-13.4/Dockerfile | 2 +- tools/fleetd-linux/fedora-43/Dockerfile | 2 +- yarn.lock | 38 +++++++++++------------ 8 files changed, 35 insertions(+), 32 deletions(-) diff --git a/.github/workflows/test-go-suite.yaml b/.github/workflows/test-go-suite.yaml index 336b9ad62d..66f46fc6b2 100644 --- a/.github/workflows/test-go-suite.yaml +++ b/.github/workflows/test-go-suite.yaml @@ -116,7 +116,7 @@ jobs: go-version-file: 'go.mod' - name: Install gotestsum - run: go install gotest.tools/gotestsum@latest + run: go install gotest.tools/gotestsum@c4a0df2e75a225d979a444342dd3db752b53619f # v1.13.0 # Pre-starting dependencies here means they are ready to go when we need them. - name: Start Infra Dependencies diff --git a/.github/workflows/test-go.yaml b/.github/workflows/test-go.yaml index c3203e9f2c..4e219cc557 100644 --- a/.github/workflows/test-go.yaml +++ b/.github/workflows/test-go.yaml @@ -131,7 +131,7 @@ jobs: go-version-file: 'go.mod' - name: Install gotestsum - run: go install gotest.tools/gotestsum@latest + run: go install gotest.tools/gotestsum@c4a0df2e75a225d979a444342dd3db752b53619f # v1.13.0 - name: verify mysql run: | diff --git a/.github/workflows/trivy-close-legacy.yml b/.github/workflows/trivy-close-legacy.yml index 5e671c4d93..af17b41a58 100644 --- a/.github/workflows/trivy-close-legacy.yml +++ b/.github/workflows/trivy-close-legacy.yml @@ -25,7 +25,7 @@ jobs: "runs": [{ "tool": { "driver": { "name": "Trivy" } }, "results": [] }] } EOF - - uses: github/codeql-action/upload-sarif@v3 + - uses: github/codeql-action/upload-sarif@8a470fddafa5cbb6266ee11b37ef4d8aae19c571 # v3.24.6 with: sarif_file: clean.sarif category: ${{ matrix.category }} diff --git a/.github/workflows/trivy-scan.yml b/.github/workflows/trivy-scan.yml index 0615a934da..9cb1b919e5 100644 --- a/.github/workflows/trivy-scan.yml +++ b/.github/workflows/trivy-scan.yml @@ -132,12 +132,14 @@ jobs: # - ee/orbit/pkg/httpsigproxy/httpsigproxy.go: TLS key only used for osquery to orbit _local_ communication # (for injection of HTTP signatures for the TPM-backed feature in Linux). # - website/config/custom.js: commented-out Stripe test-mode placeholders shown as example config. + # - ee/fleet-agent-downloader/config/custom.js: same Sails template, commented-out Stripe test placeholders. skip-files: | tools/osquery/in-a-box/osquery/fleet.key tools/osquery/fleet.key orbit/pkg/insecure/proxy.go ee/orbit/pkg/httpsigproxy/httpsigproxy.go website/config/custom.js + ee/fleet-agent-downloader/config/custom.js - name: Upload Trivy scan results to GitHub Security tab # Only upload on schedule/manual runs. PR/push uploads register diff --git a/package.json b/package.json index 0b80ebd219..7146e90688 100644 --- a/package.json +++ b/package.json @@ -36,7 +36,7 @@ "lodash": "4.18.1", "memoize-one": "5.2.1", "normalizr": "3.6.2", - "postcss": "^8.5.10", + "postcss": "8.5.10", "prop-types": "15.8.1", "proxy-middleware": "0.15.0", "rc-pagination": "1.16.3", @@ -100,7 +100,7 @@ "@testing-library/jest-dom": "6.4.2", "@testing-library/react": "15.0.2", "@testing-library/user-event": "14.5.2", - "@tsconfig/recommended": "^1.0.13", + "@tsconfig/recommended": "1.0.13", "@types/chrome": "0.0.237", "@types/classnames": "0.0.32", "@types/content-disposition": "0.5.4", @@ -171,19 +171,20 @@ "storybook": "8.6.17", "trace-unhandled": "2.0.1", "ts-loader": "6.2.2", - "typescript": "^6.0.2", + "typescript": "6.0.2", "webpack": "5.105.0", "webpack-cli": "5.0.1", "webpack-notifier": "1.12.0" }, "resolutions": { - "**/css-node-extract": "~3.0.4", - "**/css-node-extract/postcss": "^8.4.31", - "**/css-selector-extract": "~4.0.1", - "**/wait-on/axios": "^0.28.0", + "**/css-node-extract": "3.0.4", + "**/css-node-extract/postcss": "8.5.10", + "**/css-selector-extract": "4.0.1", + "**/wait-on/axios": "0.28.1", "@types/react": "18.3.12", "@types/react-dom": "18.2.0", - "**/serialize-javascript": "^7.0.3" + "**/serialize-javascript": "7.0.5", + "**/yaml": "1.10.3" }, "browserslist": [ "defaults" diff --git a/tools/fleetd-linux/debian-13.4/Dockerfile b/tools/fleetd-linux/debian-13.4/Dockerfile index f25b3db1b6..ebd6b358bb 100644 --- a/tools/fleetd-linux/debian-13.4/Dockerfile +++ b/tools/fleetd-linux/debian-13.4/Dockerfile @@ -1,4 +1,4 @@ -FROM debian:13.4 +FROM debian:13.4@sha256:e2d08da6f42ef4b09b165d55528a12727aeed8240dc9edf888e3ec07e10ef9da COPY fleet-osquery_amd64.deb / COPY run-fleetd.sh / diff --git a/tools/fleetd-linux/fedora-43/Dockerfile b/tools/fleetd-linux/fedora-43/Dockerfile index d4c746c545..3b7932f597 100644 --- a/tools/fleetd-linux/fedora-43/Dockerfile +++ b/tools/fleetd-linux/fedora-43/Dockerfile @@ -1,4 +1,4 @@ -FROM fedora:43 +FROM fedora:43@sha256:49b5f0ab05516b1a8168c79f295da65e8d8db1cae275a4bec007c0b88cd19ffb COPY fleet-osquery_amd64.rpm / COPY run-fleetd.sh / diff --git a/yarn.lock b/yarn.lock index 94097e15dd..7dada4d42e 100644 --- a/yarn.lock +++ b/yarn.lock @@ -2776,7 +2776,7 @@ resolved "https://registry.npmjs.org/@testing-library/user-event/-/user-event-14.5.2.tgz" integrity sha512-YAh82Wh4TIrxYLmfGcixwD18oIjyC1pFQC2Y01F2lzV2HTMiYrI0nze0FD0ocB//CKS/7jIUgae+adPqxK5yCQ== -"@tsconfig/recommended@^1.0.13": +"@tsconfig/recommended@1.0.13": version "1.0.13" resolved "https://registry.yarnpkg.com/@tsconfig/recommended/-/recommended-1.0.13.tgz#269fce3ad04ca70b93269ff44cca81b950f542da" integrity sha512-sySRuBfMKyKO/j2ZAhR8kSembhjuPEV4Ra3AHtmWLq51+iGaudr45crPSzNC5b7/Ctrh9dfUpBuTlYrH6rM58Q== @@ -3859,6 +3859,15 @@ axe-core@^4.2.0: resolved "https://registry.npmjs.org/axe-core/-/axe-core-4.11.1.tgz" integrity sha512-BASOg+YwO2C+346x3LZOeoovTIoTrRqEsqMa6fmfAV0P+U9mFr9NsyOEpiYvFjbc64NMrSswhV50WdXzdb/Z5A== +axios@0.28.1, axios@^1.6.1: + version "0.28.1" + resolved "https://registry.yarnpkg.com/axios/-/axios-0.28.1.tgz#2a7bcd34a3837b71ee1a5ca3762214b86b703e70" + integrity sha512-iUcGA5a7p0mVb4Gm/sy+FSECNkPFT4y7wt6OM/CDpO/OnNCvSs3PoMG8ibrC9jRoGYU0gUK5pXVC4NPXq6lHRQ== + dependencies: + follow-redirects "^1.15.0" + form-data "^4.0.0" + proxy-from-env "^1.1.0" + axios@1.15.2: version "1.15.2" resolved "https://registry.yarnpkg.com/axios/-/axios-1.15.2.tgz#eb8fb6d30349abace6ade5b4cb4d9e8a0dc23e5b" @@ -3868,15 +3877,6 @@ axios@1.15.2: form-data "^4.0.5" proxy-from-env "^2.1.0" -axios@^0.28.0, axios@^1.6.1: - version "0.28.1" - resolved "https://registry.yarnpkg.com/axios/-/axios-0.28.1.tgz#2a7bcd34a3837b71ee1a5ca3762214b86b703e70" - integrity sha512-iUcGA5a7p0mVb4Gm/sy+FSECNkPFT4y7wt6OM/CDpO/OnNCvSs3PoMG8ibrC9jRoGYU0gUK5pXVC4NPXq6lHRQ== - dependencies: - follow-redirects "^1.15.0" - form-data "^4.0.0" - proxy-from-env "^1.1.0" - axobject-query@^0.1.0: version "0.1.0" resolved "https://registry.npmjs.org/axobject-query/-/axobject-query-0.1.0.tgz" @@ -4826,7 +4826,7 @@ css-loader@^6.7.1: postcss-value-parser "^4.2.0" semver "^7.5.4" -css-node-extract@^2.1.3, css-node-extract@~3.0.4: +css-node-extract@3.0.4, css-node-extract@^2.1.3: version "3.0.4" resolved "https://registry.yarnpkg.com/css-node-extract/-/css-node-extract-3.0.4.tgz#896e454cf1626662fb373046d2464c90c340f842" integrity sha512-y0IUmFXrKOMkJNZHtvU9aKXrMUP6q60TB75S0FRqywovIxNl9i8spVsmpsMJ7uwbYn+0VmRp8aPRwcB1XRbo4g== @@ -4845,7 +4845,7 @@ css-select@^4.1.3: domutils "^2.8.0" nth-check "^2.0.1" -css-selector-extract@^3.3.6, css-selector-extract@~4.0.1: +css-selector-extract@4.0.1, css-selector-extract@^3.3.6: version "4.0.1" resolved "https://registry.yarnpkg.com/css-selector-extract/-/css-selector-extract-4.0.1.tgz#71f62916435764cd5eb338bdd962f6fef01b8795" integrity sha512-Ee2PJUE0Ma9NqCZ5AauYIsKZJA8Ni81XIbwoypv3Iid4MAPfRmjYBLxpRWsAi10D/iPIWZ5DIRGJ8dj/mRGsCQ== @@ -9675,7 +9675,7 @@ postcss-value-parser@^4.1.0, postcss-value-parser@^4.2.0: resolved "https://registry.npmjs.org/postcss-value-parser/-/postcss-value-parser-4.2.0.tgz" integrity sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ== -postcss@^7.0.36, postcss@^8.2.13, postcss@^8.2.7, postcss@^8.4.19, postcss@^8.4.31, postcss@^8.4.33, postcss@^8.5.10: +postcss@8.5.10, postcss@^7.0.36, postcss@^8.2.13, postcss@^8.2.7, postcss@^8.4.19, postcss@^8.4.33: version "8.5.10" resolved "https://registry.yarnpkg.com/postcss/-/postcss-8.5.10.tgz#8992d8c30acf3f12169e7c09514a12fed7e48356" integrity sha512-pMMHxBOZKFU6HgAZ4eyGnwXF/EvPGGqUr0MnZ5+99485wwW41kW91A4LOGxSHhgugZmSChL5AlElNdwlNgcnLQ== @@ -10670,7 +10670,7 @@ sentence-case@^3.0.4: tslib "^2.0.3" upper-case-first "^2.0.2" -serialize-javascript@^6.0.2, serialize-javascript@^7.0.3: +serialize-javascript@7.0.5, serialize-javascript@^6.0.2: version "7.0.5" resolved "https://registry.yarnpkg.com/serialize-javascript/-/serialize-javascript-7.0.5.tgz#c798cc0552ffbb08981914a42a8756e339d0d5b1" integrity sha512-F4LcB0UqUl1zErq+1nYEEzSHJnIwb3AF2XWB94b+afhrekOUijwooAYqFyRbjYkm2PAKBabx6oYv/xDxNi8IBw== @@ -11488,7 +11488,7 @@ typedarray-to-buffer@^3.1.5: dependencies: is-typedarray "^1.0.0" -typescript@^6.0.2: +typescript@6.0.2: version "6.0.2" resolved "https://registry.yarnpkg.com/typescript/-/typescript-6.0.2.tgz#0b1bfb15f68c64b97032f3d78abbf98bdbba501f" integrity sha512-bGdAIrZ0wiGDo5l8c++HWtbaNCWTS4UTv7RaTH/ThVIgjkveJt83m74bBHMJkuCbslY8ixgLBVZJIOiQlQTjfQ== @@ -12207,10 +12207,10 @@ yallist@^3.0.2: resolved "https://registry.npmjs.org/yallist/-/yallist-3.1.1.tgz" integrity sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g== -yaml@^1.10.0: - version "1.10.2" - resolved "https://registry.npmjs.org/yaml/-/yaml-1.10.2.tgz" - integrity sha512-r3vXyErRCYJ7wg28yvBY5VSoAF8ZvlcW9/BwUzEtUsjvX/DKs24dIkuwjtuprwJJHsbyUbLApepYTR1BN4uHrg== +yaml@1.10.3, yaml@^1.10.0: + version "1.10.3" + resolved "https://registry.yarnpkg.com/yaml/-/yaml-1.10.3.tgz#76e407ed95c42684fb8e14641e5de62fe65bbcb3" + integrity sha512-vIYeF1u3CjlhAFekPPAk2h/Kv4T3mAkMox5OymRiJQB0spDP10LHvt+K7G9Ny6NuuMAb25/6n1qyUjAcGNf/AA== yargs-parser@^18.1.2: version "18.1.3"