Repository navigation
🐛 Bump certifi to 2026.10.23 (drops eMudhra emSign C1 and ECC C3 roots) - #8
Merged
Merged
Conversation
rye is deprecated in favour of uv, and its lockfiles pinned certifi 2025.4.26, which still trusts the emSign ECC Root CA - G3. Switch the project to uv 0.13.4 (org standard, GHSA-hq85-5cpj-mr62): - pyproject: [tool.rye] -> [tool.uv] with required-version >=0.13.4 - uv.lock replaces requirements.lock / requirements-dev.lock; all previously pinned versions kept, certifi bumped to 2026.10.19 - Makefile: check_rye -> check_uv (0.13.4 minimum), rye run/sync -> uv run/sync, requirements target uses uv export - CI: eifinger/setup-rye -> astral-sh/setup-uv@v7 pinned to 0.13.4 - README, tests/README and .cursorrules point at uv Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Wtx3dU8PQvgyubf6ZpNaG3
actions/setup-python has no 3.12.4 build for the new ubuntu-latest image, so target_tests and vulture died before reaching uv. uv already reads .python-version and installs that interpreter itself, so drop the setup-python steps, and use uv sync --locked so CI checks the committed uv.lock. Also apply review fixes: portable awk version check in check_uv, quoted uv>= requirement in its hint, and a closed code span in .cursorrules. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Wtx3dU8PQvgyubf6ZpNaG3
litellm 1.107.0 was compromised on PyPI and Docker on 2026-10-21 (https://docs.litellm.ai/blog/security-incident-oct-21-2026). We never locked it; this adds an explicit exclusion so no future uv lock can resolve it. The locked litellm version is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Wtx3dU8PQvgyubf6ZpNaG3
Tags can be moved after review, which is how tag-rewrite supply-chain attacks land. Every GitHub Action is now pinned as <sha> # <version>, each resolved and independently re-verified against upstream (tag -> sha, upstream history, advisories). The repo has no Dockerfiles, so no image pins or ca-certificates changes apply. - scripts/check_immutable_refs.py (+ tests), exposed as `make lint_immutable_refs` (the repo has no `make ci`) and run by a new "Pinned refs" workflow: fails on untagged/:latest/tag-only images in Dockerfiles and workflow image: keys, and on any non-sha `uses:`. `# pin-exempt: <reason>` on the line above opts out. - actions/checkout v3/v4 (node20 or older, EOL) -> v6.1.0; inputs unchanged. - psf/black@stable (a moving branch) -> 26.10.1 by sha, with the matching `version: "26.10.1"` input so the formatter version is fixed too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Wtx3dU8PQvgyubf6ZpNaG3
…bun-version
- COPY --from is only parsed inside COPY instructions, and continuation
lines are joined before parsing
- A FROM's own AS alias no longer exempts its base; only earlier stages do
- $VAR / ${VAR} refs resolve from ARG defaults, which must be digest-pinned;
unresolved refs fail unless pin-exempt
- Workflow image: and scalar container: values containing ${{ }} fail closed
unless pin-exempt; an expression only counts inside the value itself
- RUN --mount=...,from=<image> is checked
- action.yml/action.yaml metadata is scanned wherever it lives; runs.image
may point at a local Dockerfile
- Dockerfile names match case-insensitively; unreadable files are errors
(deleted files are skipped)
- Action refs must fully match owner/repo[/path]@<40-hex>; quoted YAML keys
are recognised; pin-exempt covers image lines only, never uses:
- Any action input ending in "version" set to latest now fails
- Pinned refs workflow runs the base branch's copy of the guard on pull
requests so a PR cannot weaken its own check
- Makefile success message says "All non-exempt references are pinned"
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Wtx3dU8PQvgyubf6ZpNaG3
…style YAML
- Blank line clears a pending pin-exempt; blank lines inside a Dockerfile
continuation are skipped and continuation lines are joined like Docker
(no inserted space, next line's indent kept), so a split FROM can no
longer slip an unpinned image past the guard.
- Honour the "# escape=" parser directive (backtick continuations).
- action.yml runs.image is exempt only when it ends in Dockerfile, as the
runner requires; bare and docker:// images must be pinned.
- Accept flow-style keys ("- { uses: x }", "container: { image: x }") and a
space before the colon, check every uses:/image: ref on a line, and
require uses: to be owner/repo[/path]@<40-hex>.
- Pinned refs workflow comment: the base copy protects the checker script;
the workflow file itself needs CODEOWNERS or a ruleset.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Wtx3dU8PQvgyubf6ZpNaG3
Brings scripts/check_immutable_refs.py and its tests up to the current shared copy. It now scopes Dockerfile ARGs the way Docker does (FROM sees only global ARGs, a stage sees one only by redeclaring it, an empty default replaces an earlier one), reads flow-style YAML keys only on flow-collection lines, checks runs.image values with : or @ as images, and checks uses/image/container/*-version values that start on the line below their key. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Wtx3dU8PQvgyubf6ZpNaG3
Treats an anchored or tagged flow collection (`- &step { uses: ... }`,
`steps: &s [...]`) as flow style so its refs are checked, starts a
stage with its base stage's ARGs as BuildKit does, and never treats a
workflow named action.yml as action metadata. The run: fixtures in the
tests are now quoted so they are valid YAML.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Wtx3dU8PQvgyubf6ZpNaG3
…blowup
- An anchor or tag before a block key (`- &step uses: x`, `- !!str uses: x`,
`{ &k uses: x }`) no longer hides the key from the check.
- Verbatim tags with commas (`!<tag:yaml.org,2002:seq> [...]`) now open a
flow collection.
- Each node property must end at whitespace or a bracket, so a run like
`&&&&x` has one split instead of exponentially many (the old pattern hung
on 30 characters).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Wtx3dU8PQvgyubf6ZpNaG3
`!<[^>]*>` ran to the end of the line from every comma when the tag was never closed, so a flow line of repeated `,!<` was quadratic (32k repeats took 8s). YAML verbatim tags hold URI characters only, so the tag now stops at whitespace or another `<`; the same line takes 0.04s. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Wtx3dU8PQvgyubf6ZpNaG3
`bun-version: &v latest` (and `&v` with `latest` on the next line) slipped past the `latest` check because the value was taken to be `&v`, and `uses: &pin owner/repo@<sha>` was wrongly rejected for the same reason. Node properties after the colon are now skipped before the value is read, on the key's own line and on the line below it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Wtx3dU8PQvgyubf6ZpNaG3
`container: &c` followed by `{ image: <pinned> }` on the next line was
read as a scalar image and rejected. A continuation that opens a `{` or
`[` collection is now left to the per-line flow scanner, which already
checks the keys inside it, so a mutable image there is still flagged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Wtx3dU8PQvgyubf6ZpNaG3
`flow_depth` stripped only comments preceded by whitespace, so a `# }` comment at column 0 inside a multi-line flow mapping lowered the depth and a later `b: 2, uses: owner/repo@v4 }` continuation was read as block YAML and skipped. Comments at the start of a line are now stripped too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Wtx3dU8PQvgyubf6ZpNaG3
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Wtx3dU8PQvgyubf6ZpNaG3
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Wtx3dU8PQvgyubf6ZpNaG3
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Wtx3dU8PQvgyubf6ZpNaG3
|
ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
uv.lock. No other package changes.Testing
make citarget, so I ranmake test vulture lint_immutable_refs: all pass, 128 tests.Generated by Claude Code
Summary by cubic
Bumps certifi from 2026.10.19 to 2026.10.23 in
uv.lock, dropping the eMudhra emSign Root CA - C1 and emSign ECC Root CA - C3 so projects copied from this template no longer trust those roots by default. No other packages change.Written for commit d680b6e. Summary will update on new commits.