ci: action pins, and drop the pyjwt allowlist that no longer fires - #103
Merged
Conversation
Both are exact pins, so dependabot proposes nothing and they only move by hand. Release notes read rather than assumed: docker-builder 2.1.0 adds agent-address discovery and a sticky-disk mount fix with no new required inputs (a major is where that risk lives); pypi-publish 1.14.2 is a dependency refresh that takes Twine 7 internally, enabling uploads carrying core packaging metadata 2.5. Every other action in the workspace was checked the same way and is current: trivy-action 0.36.0, setup-uv 9.0.0, cosign-installer 4.1.2, setup-atlas 0.3, claude-code-action 1.0.183, checkov-action 12.3114.0, and the floating majors which are current by definition. Version pins passed as workflow INPUTS, which dependabot never sees, are also current: osv-scanner 2.4.0, node 24, python 3.13. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
PYSEC-2025-183 was suppressed in both osv-scanner.toml and the pip-audit --ignore-vuln flags, with the two kept deliberately in sync. Re-tested by removing the suppression from each: osv-scanner reports no issues, and pip-audit run without the flag reports no known vulnerabilities. pyjwt is still in the tree at 2.13.0, so this is the advisory itself lapsing rather than the dependency leaving, which fits an entry that was recorded as disputed by upstream from the start. Dropped from both places rather than one, since a stale flag in the workflow would keep suppressing an ID nothing reports and quietly outlive the file that documents why. Overrides are audited, not permanent. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two exact-pinned GitHub Actions bumped by hand, plus removal of an OSV allowlist entry that has stopped firing.
Type of change
Public API
None. CI tooling and scanner configuration only; no shipped code or exported surface changes.
Test plan
Actions. Release notes read rather than assumed.
gh-action-pypi-publish1.14.2 is a dependency refresh taking Twine 7 internally, enabling uploads that carry core packaging metadata 2.5.setup-docker-builder2.1.0 adds agent-address discovery and a sticky-disk mount fix, with no new required inputs. Both are exact pins, so dependabot proposes nothing and they only move by hand.Allowlist.
PYSEC-2025-183was suppressed in bothosv-scanner.tomland the pip-audit--ignore-vulnflags, deliberately kept in sync. Re-tested by removing the suppression from each: osv-scanner reports no issues overuv.lock(140 packages), and pip-audit run without the flag reports no known vulnerabilities.pyjwtis still in the tree at 2.13.0, so this is the advisory lapsing rather than the dependency leaving, which fits an entry recorded from the start as disputed by upstream.Dropped from both places rather than one. A stale flag left in the workflow would keep suppressing an ID nothing reports, and would outlive the file that documents why it existed.
Overrides are audited, not permanent.
Checklist