From a51da9abb4ffab471d42aff01061ea1f2fce067c Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 7 Dec 2025 16:53:26 +0000 Subject: [PATCH 1/2] Fix async-graphql directive overload vulnerability (CVE) Update async-graphql and async-graphql-axum from 6.0 to 7.0.10 to address the directive overload security vulnerability. Versions prior to 7.0.10 are susceptible to service disruption and resource exhaustion. Fixes Dependabot alert #1 --- src/rust/Cargo.toml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/rust/Cargo.toml b/src/rust/Cargo.toml index 31a3046..1e181f8 100644 --- a/src/rust/Cargo.toml +++ b/src/rust/Cargo.toml @@ -44,8 +44,8 @@ criterion = { version = "0.5", optional = true } rayon = "1.8" # GraphQL server (optional) -async-graphql = { version = "6.0", optional = true } -async-graphql-axum = { version = "6.0", optional = true } +async-graphql = { version = "7.0.10", optional = true } +async-graphql-axum = { version = "7.0.10", optional = true } axum = { version = "0.7", optional = true } [dev-dependencies] From 7fcbce885359c7565414d5fa01490cbabed900d3 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 8 Dec 2025 18:19:00 +0000 Subject: [PATCH 2/2] Pin all GitHub Actions to full commit SHAs Pin all actions to immutable commit SHAs to comply with repository security policy and prevent supply chain attacks. Each action includes a version comment for maintainability. Actions pinned: - actions/checkout@v4 - actions/upload-artifact@v4 - actions/download-artifact@v4 - julia-actions/setup-julia@v1 - julia-actions/julia-processcoverage@v1 - codecov/codecov-action@v4 - actions-rust-lang/setup-rust-toolchain@v1 - gitleaks/gitleaks-action@v2 - aquasecurity/trivy-action@master - github/codeql-action/upload-sarif@v3 - snyk/actions/node@master - dependency-check/Dependency-Check_Action@main - docker/setup-buildx-action@v3 - docker/login-action@v3 - docker/metadata-action@v5 - docker/build-push-action@v5 - hadolint/hadolint-action@v3.1.0 - anchore/scan-action@v3 - SonarSource/sonarcloud-github-action@master - 8398a7/action-slack@v3.9.3 --- .github/workflows/ci-cd.yml | 66 ++++++++++++++++++------------------- 1 file changed, 33 insertions(+), 33 deletions(-) diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml index 36f6f7b..4858485 100644 --- a/.github/workflows/ci-cd.yml +++ b/.github/workflows/ci-cd.yml @@ -22,12 +22,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: fetch-depth: 0 # Full history for SonarCloud - name: Set up Julia - uses: julia-actions/setup-julia@v1 + uses: julia-actions/setup-julia@ac0d62164df5a47de404f4e96ce86a1a28a28d56 # v1 with: version: ${{ env.JULIA_VERSION }} @@ -58,16 +58,16 @@ jobs: contents: read steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Run GitLeaks (secrets detection) - uses: gitleaks/gitleaks-action@v2 + uses: gitleaks/gitleaks-action@dcedce43c6f43de0b836d1fe38946645c9c638dc # v2 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} - name: Run Trivy vulnerability scanner (filesystem) - uses: aquasecurity/trivy-action@master + uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # master with: scan-type: 'fs' scan-ref: '.' @@ -76,13 +76,13 @@ jobs: severity: 'CRITICAL,HIGH' - name: Upload Trivy results to GitHub Security - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@4248455a6f2335bc3b7a8a62932f000050ec8f13 # v3 if: always() with: sarif_file: 'trivy-results.sarif' - name: Run Snyk security scan - uses: snyk/actions/node@master + uses: snyk/actions/node@9adf32b1121593767fc3c057af55b55db032dc04 # master continue-on-error: true env: SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} @@ -90,7 +90,7 @@ jobs: args: --severity-threshold=high - name: OWASP Dependency Check - uses: dependency-check/Dependency-Check_Action@main + uses: dependency-check/Dependency-Check_Action@2ba636726705b0f74f126ebeaacaf2ad4600b967 # main with: project: 'robot-vacuum-cleaner' path: '.' @@ -99,7 +99,7 @@ jobs: continue-on-error: true - name: Upload dependency check report - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 if: always() with: name: dependency-check-report @@ -114,10 +114,10 @@ jobs: julia-version: ['1.9', '1.10', 'nightly'] steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Set up Julia ${{ matrix.julia-version }} - uses: julia-actions/setup-julia@v1 + uses: julia-actions/setup-julia@ac0d62164df5a47de404f4e96ce86a1a28a28d56 # v1 with: version: ${{ matrix.julia-version }} @@ -132,12 +132,12 @@ jobs: julia --project=. -e 'using Pkg; Pkg.test(coverage=true)' - name: Process coverage - uses: julia-actions/julia-processcoverage@v1 + uses: julia-actions/julia-processcoverage@03114f09f119417c3242a9fb6e0b722676aedf38 # v1 with: directories: src/julia/RobotVacuum/src - name: Upload coverage to Codecov - uses: codecov/codecov-action@v4 + uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4 with: files: lcov.info flags: julia-${{ matrix.julia-version }} @@ -150,10 +150,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Install Rust toolchain - uses: actions-rust-lang/setup-rust-toolchain@v1 + uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1 with: toolchain: ${{ env.RUST_VERSION }} components: rustfmt, clippy @@ -180,7 +180,7 @@ jobs: continue-on-error: true - name: Upload Rust coverage - uses: codecov/codecov-action@v4 + uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4 with: file: src/rust/coverage/cobertura.xml flags: rust @@ -199,14 +199,14 @@ jobs: security-events: write steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3 - name: Log in to Container Registry if: github.event_name != 'pull_request' - uses: docker/login-action@v3 + uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} @@ -214,7 +214,7 @@ jobs: - name: Extract metadata id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} tags: | @@ -226,7 +226,7 @@ jobs: type=raw,value=latest,enable={{is_default_branch}} - name: Build container image - uses: docker/build-push-action@v5 + uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5 with: context: . file: ./docker/Containerfile @@ -238,7 +238,7 @@ jobs: cache-to: type=gha,mode=max - name: Run Trivy vulnerability scanner (image) - uses: aquasecurity/trivy-action@master + uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # master with: image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} format: 'sarif' @@ -246,19 +246,19 @@ jobs: severity: 'CRITICAL,HIGH' - name: Upload Trivy image results - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@4248455a6f2335bc3b7a8a62932f000050ec8f13 # v3 if: always() with: sarif_file: 'trivy-image-results.sarif' - name: Run Hadolint (Dockerfile linting) - uses: hadolint/hadolint-action@v3.1.0 + uses: hadolint/hadolint-action@54c9adbab1582c2ef04b2016b760714a4bfde3cf # v3.1.0 with: dockerfile: docker/Containerfile failure-threshold: warning - name: Scan with Grype - uses: anchore/scan-action@v3 + uses: anchore/scan-action@3343887d815d7b07465f6fdcd395bd66508d486a # v3 with: image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} fail-build: false @@ -266,7 +266,7 @@ jobs: - name: Push container image if: github.event_name != 'pull_request' - uses: docker/build-push-action@v5 + uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5 with: context: . file: ./docker/Containerfile @@ -281,18 +281,18 @@ jobs: needs: [test-julia] steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: fetch-depth: 0 - name: Download Julia coverage - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: julia-coverage path: htmlcov/ - name: SonarCloud Scan - uses: SonarSource/sonarcloud-github-action@master + uses: SonarSource/sonarcloud-github-action@ba3875ecf642b2129de2b589510c81a8b53dbf4e # master env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} @@ -337,10 +337,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Set up Julia - uses: julia-actions/setup-julia@v1 + uses: julia-actions/setup-julia@ac0d62164df5a47de404f4e96ce86a1a28a28d56 # v1 with: version: ${{ env.JULIA_VERSION }} @@ -371,7 +371,7 @@ jobs: url: https://robot-vacuum.example.com steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Deploy to production run: | @@ -380,7 +380,7 @@ jobs: # e.g., kubectl apply, helm upgrade, etc. - name: Notify deployment - uses: 8398a7/action-slack@v3 + uses: 8398a7/action-slack@047b09b154480ed39076984b64f324fff010d703 # v3.9.3 if: always() with: status: ${{ job.status }}