Skip to content

fix: resolve #480 CI failures — dependency bumps and util-linux CVE exceptions #484

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
RonaldHensbergen merged 1 commit into from
Aug 22, 2026
+19 −15
Merged

fix: resolve #480 CI failures — dependency bumps and util-linux CVE exceptions #484

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 9 additions & 10 deletions .trivyignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,14 +22,13 @@
# owner:@RonaldHensbergen
CVE-2026-53615 exp:2026-11-15

# sqlparse < 0.6.0 (pulled via dbt-core 1.12.2, which pins
# sqlparse<0.6.0,>=0.5.5). Advisories published 2026-08-17, fixed
# in 0.6.0: ReDoS and quadratic DoS in SQL parsing.
# CVE-2026-53612/53613/53614: util-linux mount TOCTOU and nosuid/noexec
# bypass. Fixed by 2.41.5-0+deb13u1 in trixie-security; no
# python:3.14-slim digest ships it yet (checked 2026-08-21). Renovate
# bumps the digest when upstream rebuilds; drop these entries then.
# owner:@RonaldHensbergen
CVE-2026-54284 exp:2026-11-15
# owner:@RonaldHensbergen — ReDoS, same cause as CVE-2026-54284
CVE-2026-59893 exp:2026-11-15
# owner:@RonaldHensbergen — tokenization DoS, same root cause
CVE-2026-59894 exp:2026-11-15
# owner:@RonaldHensbergen — group_comments quadratic DoS
CVE-2026-71491 exp:2026-11-15
CVE-2026-53612 exp:2026-11-15
# owner:@RonaldHensbergen — TOCTOU ancestor directory swap, same fix
CVE-2026-53613 exp:2026-11-15
# owner:@RonaldHensbergen — SUID mount nosuid/noexec bypass, same fix
CVE-2026-53614 exp:2026-11-15
2 changes: 1 addition & 1 deletion images/dagster/requirements-postgres.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
dagster-postgres==0.29.18
dagster-postgres==0.29.19
6 changes: 3 additions & 3 deletions images/dagster/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
dagster==1.13.18
dagster-graphql==1.13.18
dagster-webserver==1.13.18
dagster==1.13.19
dagster-graphql==1.13.19
dagster-webserver==1.13.19
msgpack>=1.2.1
setuptools>=78.1.1
7 changes: 6 additions & 1 deletion images/dbt/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,11 @@
# deepdiff<9.0,>=7.0 constraint lets pip resolve a patched deepdiff. Bump
# both dbt-core and dbt-postgres together (no compatible dbt-common exists
# that relaxes deepdiff without also raising the protobuf floor).
dbt-core==1.12.2
# dbt-core 1.12.3 widens the sqlparse constraint to >=0.5.5,<0.7.0, allowing
# pip to resolve sqlparse 0.6.0 (fixed for CVE-2026-54284, CVE-2026-59893,
# CVE-2026-59894, CVE-2026-71491). Pin sqlparse>=0.6.0 explicitly to ensure
# the patched version is always installed.
dbt-core==1.12.3
dbt-postgres==1.11.0
deepdiff>=8.6.2
sqlparse>=0.6.0