Skip to content

reassess the expired npmplus packaging-tool baseline #80

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mangyan1 merged 1 commit into from
Oct 5, 2026
Merged

reassess the expired npmplus packaging-tool baseline #80

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 10 additions & 10 deletions .trivy/npmplus.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,19 +1,19 @@
# Packaging-tool exceptions; reviewed on 2026-10-02, all expire 2026-10-04.
# Scanned with Trivy 0.74.0 on 2026-10-02: ghcr.io/mangyan1/npmplus@sha256:a23d3d57a509feb8a0e38f576bee1db14d30c048a55bb42ed8a364d2d3d95430
# Packaging-tool exceptions; reviewed on 2026-10-04, all expire 2026-10-11.
# Scanned with Trivy 0.74.0 on 2026-10-04: ghcr.io/mangyan1/npmplus@sha256:e9e90bc214ff757290e4b929f68ea12bc2afc724bb0efc7ae6abb9c08a601bff
vulnerabilities:
- id: CVE-2025-47273
expired_at: 2026-10-04
statement: "Rechecked 2026-10-02: setuptools metadata finding persists, but no installed setuptools distribution is listed by Python. Keep upstream-compatible Certbot runtime plugin support; reassess with the next pip image update."
expired_at: 2026-10-11
statement: "Rechecked 2026-10-04: setuptools 70.3.0 metadata finding persists, but no installed setuptools distribution is listed by Python; pip 26.2.1 is still the latest release. Keep upstream-compatible Certbot runtime plugin support; reassess with the next pip image update."
- id: GHSA-6v7p-g79w-8964
expired_at: 2026-10-04
statement: "Rechecked 2026-10-02: pip 26.2.1 vendors msgpack 1.1.2; scanner lists 1.2.1 as fixed. Runtime Certbot plugin installation remains intentional; await a reviewed pip vendor update rather than modifying its bundled modules."
expired_at: 2026-10-11
statement: "Rechecked 2026-10-04: pip 26.2.1 vendors msgpack 1.1.2; scanner lists 1.2.1 as fixed; pip 26.2.1 is still the latest release. Runtime Certbot plugin installation remains intentional; await a reviewed pip vendor update rather than modifying its bundled modules."
- id: CVE-2026-97687
purls:
- pkg:pypi/urllib3@2.7.0
expired_at: 2026-10-04
statement: "Reviewed 2026-10-02: latest stable pip 26.2.1 embeds urllib3 2.7.0 in its vendor bundle/SBOM; the separately installed Certbot urllib3 is pinned to patched 2.8.0 and pip check passes. Accept the remaining packaging-tool HTTPS-proxy TLS risk temporarily under the owner decision preserving runtime DNS-plugin installation; not universally unreachable. Await a fixed pip release, retain suppressed findings in artifacts, and reassess by expiry. Advisory: https://github.com/advisories/GHSA-8988-9cw3-xx77"
expired_at: 2026-10-11
statement: "Rechecked 2026-10-04: pip 26.2.1 is still the latest release and still embeds urllib3 2.7.0 in its vendor bundle/SBOM; the separately installed Certbot urllib3 remains pinned to patched 2.8.0 and pip check passes. Accept the remaining packaging-tool HTTPS-proxy TLS risk temporarily under the owner decision preserving runtime DNS-plugin installation; not universally unreachable. Await a fixed pip release, retain suppressed findings in artifacts, and reassess by expiry. Advisory: https://github.com/advisories/GHSA-8988-9cw3-xx77"
- id: CVE-2026-97689
purls:
- pkg:pypi/urllib3@2.7.0
expired_at: 2026-10-04
statement: "Reviewed 2026-10-02: latest stable pip 26.2.1 embeds urllib3 2.7.0 in its vendor bundle/SBOM; installed Certbot urllib3 is patched at 2.8.0. Malicious chunked responses during pip downloads remain a packaging-tool availability risk, not a false positive. Keep runtime DNS-plugin installation per the owner decision, do not modify pip's bundled modules, retain suppressed findings in artifacts, and reassess by expiry. Advisory: https://github.com/advisories/GHSA-vxq7-64xx-v4gw"
expired_at: 2026-10-11
statement: "Rechecked 2026-10-04: pip 26.2.1 is still the latest release and still embeds urllib3 2.7.0; installed Certbot urllib3 is patched at 2.8.0. Malicious chunked responses during pip downloads remain a packaging-tool availability risk, not a false positive. Keep runtime DNS-plugin installation per the owner decision, do not modify pip's bundled modules, retain suppressed findings in artifacts, and reassess by expiry. Advisory: https://github.com/advisories/GHSA-vxq7-64xx-v4gw"
Loading