Commit 8854ed2
Fix HIGH-level OpenSSF Scorecard code scanning alerts (VulnerabilitiesID) (#175)
* Fix HIGH-level code scanning alerts: pin safe dep versions, add fuzz tests
- Add urllib3>=2.6.3 and setuptools>=78.1.1 to requirements-test.txt to
eliminate known vulnerabilities reported by the OpenSSF Scorecard's
VulnerabilitiesID check (3 urllib3 vulns + 2 setuptools vulns fixed)
- Add fuzz/fuzz_paths.py and fuzz/fuzz_io.py using atheris to address the
FuzzingID HIGH-level code scanning alert
- Add requirements-fuzz.txt with the atheris dependency
Agent-Logs-Url: https://github.com/fabiocaccamo/python-fsutil/sessions/1f637139-c97f-4823-b5fc-3014996d3a72
Co-authored-by: fabiocaccamo <1035294+fabiocaccamo@users.noreply.github.com>
* Remove incorrectly added fuzz tests (FuzzingID is MEDIUM severity, not HIGH)
Agent-Logs-Url: https://github.com/fabiocaccamo/python-fsutil/sessions/64e8453b-edc0-4c64-ba6a-96fb37caeef5
Co-authored-by: fabiocaccamo <1035294+fabiocaccamo@users.noreply.github.com>
* Pin setuptools and urllib3 to exact versions in requirements-test.txt
Agent-Logs-Url: https://github.com/fabiocaccamo/python-fsutil/sessions/76cee033-860f-4bc5-b5d3-a08fbee09d60
Co-authored-by: fabiocaccamo <1035294+fabiocaccamo@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: fabiocaccamo <1035294+fabiocaccamo@users.noreply.github.com>1 parent 8693f3e commit 8854ed2
1 file changed
Lines changed: 2 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
4 | 4 | | |
5 | 5 | | |
6 | 6 | | |
| 7 | + | |
7 | 8 | | |
| 9 | + | |
0 commit comments