fix: address security alerts (workflow permissions + cryptography CVEs)#21
Merged
reubenmiller merged 3 commits intomainfrom Apr 21, 2026
Merged
fix: address security alerts (workflow permissions + cryptography CVEs)#21reubenmiller merged 3 commits intomainfrom
reubenmiller merged 3 commits intomainfrom
Conversation
reubenmiller
requested a deployment
to
Test Pull Request
GitHub Actions
Waiting
reubenmiller
temporarily deployed
to
Test Pull Request
GitHub Actions
Inactive
Robot Results
Passed Tests
|
Update cryptography minimum version from 44.0.2 to 46.0.6 to address two security vulnerabilities: - CVE-2026-26007 (high): Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves (fixed in 46.0.5) - CVE-2026-34073 (low): Incomplete DNS name constraint enforcement on peer names (fixed in 46.0.6) Fixes Dependabot alerts #2 and #3
reubenmiller
force-pushed
the
fix/security-alerts
branch
from
a24b82c to
7583c62
Compare
reubenmiller
requested a deployment
to
Test Pull Request
GitHub Actions
Waiting
reubenmiller
temporarily deployed
to
Test Pull Request
GitHub Actions
Inactive
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes open security alerts from code scanning and Dependabot (excluding code scanning alert #1 which is a known/accepted risk).
Code Scanning Alerts Fixed
actions/missing-workflow-permissions: Added explicitpermissionsblocks tolint,approve, andpassedjobs in.github/workflows/test.yamlto restrict the scope of theGITHUB_TOKENfollowing the principle of least privilege:lint→contents: read(required for checkout)approve→{}(no repository access needed)passed→{}(no repository access needed)Dependabot Alerts Fixed
CVE-2026-26007:cryptographyVulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves — fixed in 46.0.5CVE-2026-34073:cryptographyhas incomplete DNS name constraint enforcement on peer names — fixed in 46.0.6Bumped
cryptographyfrom>= 44.0.2, < 45.0.0to>= 46.0.6, < 47.0.0.Commits
ci: add explicit permissions to workflow jobs— fixes code scanning alerts fix: only initialize session when used #2, ci: switch to pull_request_target event #3, test: use random policy names #4build: bump cryptography to >= 46.0.6 to fix CVEs— fixes Dependabot alerts fix: only initialize session when used #2 and ci: switch to pull_request_target event #3