fix: remediate fixable grype vulnerabilities in evaluator deps - #679
Open
scottschreckengaust wants to merge 1 commit into
Open
fix: remediate fixable grype vulnerabilities in evaluator deps#679scottschreckengaust wants to merge 1 commit into
scottschreckengaust wants to merge 1 commit into
Conversation
Grype's daily scan and PR checks were failing on High-severity SCA findings in the aidlc-evaluator lockfile. This upgrades the fixable packages and documents a risk-accepted suppression for the one finding that cannot be upgraded. Upgraded (transitive, via `uv lock --upgrade-package`): - pillow 12.2.0 -> 12.3.0 (clears 10 High + 2 Medium GHSAs) - pydantic-settings 2.14.1 -> 2.14.2 (clears 1 Medium GHSA) Suppressed in .grype.yaml (cannot upgrade): - mcp 1.23.3 (GHSA-jpw9-pfvf-9f58, GHSA-hvrp-rf83-w775, GHSA-vj7q-gjh5-988w). mcp is a transitive, dev-only dependency hard-pinned by semgrep (`mcp==1.23.3`, including semgrep's latest release), so it cannot be bumped without breaking the semgrep dev tool. All three advisories affect the MCP Python SDK's HTTP/WebSocket server transports, which are never exercised: mcp is pulled in only via semgrep's CLI, no MCP server is run, and nothing in this repo imports mcp. Scanning the evaluator's tracked dependency manifests now reports no vulnerabilities (grype exit 0). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
scottschreckengaust
marked this pull request as ready for review
July 29, 2026 08:34
scottschreckengaust
requested review from
a team,
Kalindi-Dev,
apackeer,
harmjeff,
leandrodamascena,
raj-jain-aws and
spraja08
July 29, 2026 08:34
scottschreckengaust
enabled auto-merge
July 29, 2026 08:34
leandrodamascena
approved these changes
Jul 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The Grype scanner (daily scheduled run + PR checks in
.github/workflows/security-scanners.yml) was failing on High-severity dependency findings inscripts/aidlc-evaluator/uv.lock. This PR remediates every fixable finding and documents a risk-accepted suppression for the one that cannot be upgraded.Changes
Upgraded via
uv lock --upgrade-package(transitive deps):Suppressed in
.grype.yaml(cannot upgrade):mcp1.23.3 —GHSA-jpw9-pfvf-9f58,GHSA-hvrp-rf83-w775,GHSA-vj7q-gjh5-988wmcpis a transitive, dev-only dependency hard-pinned bysemgrep(mcp==1.23.3, including semgrep's latest release), so it cannot be bumped without breaking the semgrep dev tool. All three advisories affect the MCP Python SDK's HTTP/WebSocket server transports, which are never exercised:mcpis pulled in only via semgrep's CLI, no MCP server is run, and nothing in this repo importsmcp.Verification
Scanning the evaluator's tracked dependency manifests with the updated config reports no vulnerabilities (grype exit 0):
Package test suites still pass (e.g.
reporting: 33 passed,shared: 15 passed).