From 14de62722b796eb17cc441d287befa71775551e1 Mon Sep 17 00:00:00 2001 From: YanNaingWinn Date: Tue, 7 Apr 2026 17:34:27 +0700 Subject: [PATCH 1/6] Resolved dependabot security alerts --- dev-requirements.txt | Bin 4036 -> 4138 bytes requirements.txt | Bin 1160 -> 1160 bytes 2 files changed, 0 insertions(+), 0 deletions(-) diff --git a/dev-requirements.txt b/dev-requirements.txt index f8f6aa493900753bf89cc666d25f255d4c94294f..81b70b62d3d8134af2d2d365d88db3768f53a27b 100644 GIT binary patch delta 358 zcmW;HJxjw-7zN-rUrlb(n@+_clqljLf*-Bbse(8;lp-ZK6o(=uI8+2J;@Hv6_709N zI;ew)h@*?*ZNf*FTRd+EW**Pnd$aJ<+lJ-B6Z|N! zllXh^)aUkhpUos-J_xwyIbcUA=1g@tQM}I&JFpwF`4F<>MD2=}P>$qGa_LJ?4&_9S zWkVWLl|`wV8D0PXLvtJPS-(*Vr;5yZvE|^fxr!63X1>%qW=iv-j$VT2x&m+XCY^CAPz;Tj}9WGh&Y50E+I&9kPc1`4&v?qmeT+ zE;%)?DNRMk+E~aHw^mGPWvtsNH+D{GcbMBJ9MnJ1_3FtvC)2 zbMKv_J;jkf;>AzUe&q*>r(nh0uJu`q_R&GgFl;goQ{nR|mnp-YYW>NU*j?l@iWKir hm+xqm-)O+0+~P_qrg9T4yR;h@+%;0Z8nNNm{sBp8Q&Io` diff --git a/requirements.txt b/requirements.txt index 6dbe6369e85eac1b060d3828204bcdee5d39c851..c86b8d97b6ce26f6f60d17b8ee7ab86ebd078314 100644 GIT binary patch delta 30 jcmeC+?BJZRhtXuRA+zPg1#BDtSTHi0fjFD Date: Thu, 9 Apr 2026 13:40:54 +0700 Subject: [PATCH 2/6] Pin vulnerable transitive dependencies to safe minimum versions Add explicit minimum version constraints to dev-requirements.txt to resolve OSV-scanner security alerts: - protobuf>=5.29.6 (GHSA-7gcm-g887-7qv7, CVSS 8.2) - python-multipart>=0.0.22 (GHSA-59g5-xgcq-4qw3 + GHSA-wp53-j4wj-2cfg, CVSS 8.7/8.6) - zipp>=3.19.1 (GHSA-jfmj-5v4g-7637, CVSS 6.9) Co-Authored-By: Claude Sonnet 4.6 --- dev-requirements.txt | Bin 4138 -> 4254 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/dev-requirements.txt b/dev-requirements.txt index 81b70b62d3d8134af2d2d365d88db3768f53a27b..40923999930d4de610b7f04ced3443d7835b5be0 100644 GIT binary patch delta 120 zcmZ3bFi&xV7q@H?Lq0iQLc?`M? zxj;oZK;@YX1q_J{ML-rvg8@(}2pcgNZQjUJ$t+U^R!{(zGzLl-f=x4I;AP-q007XJ B73cr} delta 17 YcmbQIxJqGz7x(5o?gGZmLc9gc060+vaR2}S From 145fed5664a1f9c8eb4b9d176012b7233eb10a4d Mon Sep 17 00:00:00 2001 From: YanNaingWinn Date: Thu, 9 Apr 2026 18:37:15 +0700 Subject: [PATCH 3/6] Fix OSV-Scanner CI by scanning resolved installed versions --- .github/workflows/osv-scanner.yml | 116 ++++++++++++------------------ 1 file changed, 47 insertions(+), 69 deletions(-) diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml index 4d36085..04de10e 100644 --- a/.github/workflows/osv-scanner.yml +++ b/.github/workflows/osv-scanner.yml @@ -24,119 +24,97 @@ permissions: jobs: osv-scan: runs-on: ubuntu-latest - + steps: - name: Checkout code uses: actions/checkout@v4 - - - name: Prepare requirements for scanning + + - name: Set up Python + uses: actions/setup-python@v5 + with: + python-version: '3.12' + + - name: Install dependencies and resolve exact versions run: | - # Use Python to safely read files with correct encoding (handling BOMs automatically) + python -m pip install --upgrade pip + + # Read requirements files handling UTF-16 BOM encoding python3 -c " import sys - + def process_file(filename): try: - # Open with utf-8-sig to handle UTF-8 BOM, errors='replace' to handle binary/UTF-16 confusion - # Ideally we would detect encoding, but requirements files should be text with open(filename, 'r', encoding='utf-8', errors='replace') as f: content = f.read() - # If it looks like UTF-16 (null bytes), try re-reading - if '\x00' in content: - with open(filename, 'r', encoding='utf-16') as f2: - content = f2.read() - + if '\x00' in content: + with open(filename, 'r', encoding='utf-16') as f2: + content = f2.read() + lines = [] for line in content.splitlines(): line = line.strip() if not line or line.startswith(('#', '-i', '--')): continue - # Remove markers - line = line.split(';')[0].strip() - if line: - print(line) + lines.append(line) + return lines except Exception as e: print(f'Error processing {filename}: {e}', file=sys.stderr) - - process_file('requirements.txt') - process_file('dev-requirements.txt') - " | sort -u > combined-requirements.txt - - echo "Combined requirements file created:" - if [ -s combined-requirements.txt ]; then - echo " Total packages: $(wc -l < combined-requirements.txt)" - echo "" - echo "Package list (first 10):" - head -10 combined-requirements.txt - else - echo "Error: combined-requirements.txt is empty!" - echo "Debug: File listing:" - ls -l requirements.txt dev-requirements.txt - fi - echo "" - + return [] + + lines = process_file('requirements.txt') + process_file('dev-requirements.txt') + for line in lines: + print(line) + " > combined-requirements.txt + + echo "Installing packages to resolve exact versions..." + pip install -r combined-requirements.txt --quiet + + echo "Generating resolved lockfile from installed packages..." + pip freeze > installed-requirements.txt + + echo "Resolved packages (first 10):" + head -10 installed-requirements.txt + echo "Total: $(wc -l < installed-requirements.txt) packages" + - name: Install OSV-Scanner run: | curl -LO https://github.com/google/osv-scanner/releases/latest/download/osv-scanner_linux_amd64 chmod +x osv-scanner_linux_amd64 sudo mv osv-scanner_linux_amd64 /usr/local/bin/osv-scanner - + - name: Run OSV-Scanner id: osv-scanner continue-on-error: true run: | - echo "Running OSV-Scanner dependency vulnerability check..." + echo "Running OSV-Scanner on resolved installed versions..." echo "==================================================" echo "" - - # Check if combined file has content - if [ ! -s combined-requirements.txt ]; then - echo "Error: combined-requirements.txt is empty!" - echo "Falling back to scanning requirements.txt only..." - LOCKFILE="requirements.txt" - else - LOCKFILE="combined-requirements.txt" - fi - - echo "Scanning: $LOCKFILE" - echo "" - - # Run scan and capture exit code + set +e - osv-scanner --lockfile="$LOCKFILE" + osv-scanner --lockfile=installed-requirements.txt SCAN_EXIT_CODE=$? set -e - - # Exit code 128 means no packages found, which should not happen - if [ $SCAN_EXIT_CODE -eq 128 ]; then - echo "" - echo "OSV-Scanner found no packages to scan" - echo "Debug: Contents of $LOCKFILE:" - cat "$LOCKFILE" - exit 1 - fi - + echo "" echo "Generating SARIF report..." - osv-scanner --lockfile="$LOCKFILE" --format=sarif --output=results.sarif 2>&1 || { - echo "⚠️ SARIF generation encountered issues (possibly plugin warning)" + osv-scanner --lockfile=installed-requirements.txt --format=sarif --output=results.sarif 2>&1 || { + echo "⚠️ SARIF generation encountered issues" echo " Scan results are still valid - see output above" } - + if [ -f results.sarif ] && [ -s results.sarif ]; then echo "✓ SARIF file created successfully" ls -lh results.sarif fi - - # Return the original scan exit code + exit $SCAN_EXIT_CODE - + - name: Upload SARIF results to GitHub Security if: always() && hashFiles('results.sarif') != '' uses: github/codeql-action/upload-sarif@v4 with: sarif_file: results.sarif category: osv-scanner - + - name: Success - No vulnerabilities found if: steps.osv-scanner.outcome == 'success' run: | @@ -147,7 +125,7 @@ jobs: echo "All Python dependencies (requirements.txt + dev-requirements.txt)" echo "are free of known vulnerabilities." echo "" - + - name: Check OSV-Scanner results if: steps.osv-scanner.outcome == 'failure' run: | From 0177c01677143f97a44aafad6b94f85d67c64324 Mon Sep 17 00:00:00 2001 From: YanNaingWinn Date: Thu, 9 Apr 2026 18:45:27 +0700 Subject: [PATCH 4/6] Resolved osv errors --- .github/workflows/osv-scanner.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml index 04de10e..39cfa82 100644 --- a/.github/workflows/osv-scanner.yml +++ b/.github/workflows/osv-scanner.yml @@ -34,6 +34,9 @@ jobs: with: python-version: '3.12' + - name: Install system dependencies for pyscard + run: sudo apt-get install -y libpcsclite-dev swig + - name: Install dependencies and resolve exact versions run: | python -m pip install --upgrade pip From 4b2886f6149d668de692259bd31f8a9fc85f6910 Mon Sep 17 00:00:00 2001 From: YanNaingWinn Date: Thu, 9 Apr 2026 19:02:45 +0700 Subject: [PATCH 5/6] Pin OSV-Scanner to v2.3.5 for reproducible CI builds --- .github/workflows/osv-scanner.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml index 39cfa82..b7eaf0a 100644 --- a/.github/workflows/osv-scanner.yml +++ b/.github/workflows/osv-scanner.yml @@ -80,7 +80,7 @@ jobs: - name: Install OSV-Scanner run: | - curl -LO https://github.com/google/osv-scanner/releases/latest/download/osv-scanner_linux_amd64 + curl -LO https://github.com/google/osv-scanner/releases/download/v2.3.5/osv-scanner_linux_amd64 chmod +x osv-scanner_linux_amd64 sudo mv osv-scanner_linux_amd64 /usr/local/bin/osv-scanner From f7a5c2d5d1358e50b6c400c3b7284106495cee15 Mon Sep 17 00:00:00 2001 From: YanNaingWinn Date: Thu, 9 Apr 2026 19:10:15 +0700 Subject: [PATCH 6/6] Modified osv scanner --- .github/workflows/osv-scanner.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml index b7eaf0a..09dbd66 100644 --- a/.github/workflows/osv-scanner.yml +++ b/.github/workflows/osv-scanner.yml @@ -80,7 +80,8 @@ jobs: - name: Install OSV-Scanner run: | - curl -LO https://github.com/google/osv-scanner/releases/download/v2.3.5/osv-scanner_linux_amd64 + OSV_VERSION="v2.3.5" + curl -LO https://github.com/google/osv-scanner/releases/download/${OSV_VERSION}/osv-scanner_linux_amd64 chmod +x osv-scanner_linux_amd64 sudo mv osv-scanner_linux_amd64 /usr/local/bin/osv-scanner