Skip to content

fix(security): remediate 19 supply-chain vulnerabilities in 9 Python packages#31

Merged
yu-iskw merged 4 commits intomainfrom
copilot/remediate-supply-chain-vulnerabilities
Apr 17, 2026
Merged

fix(security): remediate 19 supply-chain vulnerabilities in 9 Python packages#31
yu-iskw merged 4 commits intomainfrom
copilot/remediate-supply-chain-vulnerabilities

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Apr 17, 2026

Copilot AI and others added 2 commits April 17, 2026 03:19
Direct dependencies:
- mcp[cli]: >=1.9.2 → >=1.23.0 (CVE-2025-53366, CVE-2025-53365, CVE-2025-66416)
- google-cloud-aiplatform: >=1.96.0 → >=1.133.0 (CVE-2026-2473)

Transitive constraints added via [tool.uv.constraint-dependencies]:
- protobuf>=6.33.5 (CVE-2026-0994)
- pyasn1>=0.6.3 (CVE-2026-23490, CVE-2026-30922)
- pygments>=2.20.0 (CVE-2026-4539)
- python-multipart>=0.0.26 (CVE-2026-24486, CVE-2026-40347)
- requests>=2.33.0 (CVE-2024-47081, CVE-2026-25645)
- starlette>=0.49.1 (CVE-2025-54121, CVE-2025-62727)
- urllib3>=2.6.3 (CVE-2025-50181/50182/66418/66471, CVE-2026-21441)

Regenerated uv.lock - all 12 tests pass, pip-audit clean.

Agent-Logs-Url: https://github.com/ubie-oss/mcp-vertexai-search/sessions/f040b520-ca92-4fce-bfbc-1c162c8ce9de

Co-authored-by: yu-iskw <[email protected]>
@yu-iskw
Copy link
Copy Markdown
Contributor

yu-iskw commented Apr 17, 2026

@copilot Can you fix to pass the failed CI jobs?

[email protected] crashes with ModuleNotFoundError: No module named
'pkg_resources'. Bumping to 1.157.0 (as recommended by the open
Trunk upgrade PR) fixes the crash."

Agent-Logs-Url: https://github.com/ubie-oss/mcp-vertexai-search/sessions/d208e6c7-30bd-45f6-a74c-8402c116efb6

Co-authored-by: yu-iskw <[email protected]>
Copy link
Copy Markdown
Contributor Author

Copilot AI commented Apr 17, 2026

@copilot Can you fix to pass the failed CI jobs?

The Trunk Check was failing because [email protected] crashes with ModuleNotFoundError: No module named 'pkg_resources' — a pre-existing bug in that version of semgrep (visible on other branches too). Fixed in aa724e2 by bumping semgrep to 1.157.0 in .trunk/trunk.yaml, matching what the open Trunk upgrade PR #21 recommends.

…t exist)

[email protected] fails with HTTP 404 because that release tag does not exist
in aquasecurity/trivy. Updating to 0.69.2 which is the trunk-io/plugins
known_good_version for trivy.

Agent-Logs-Url: https://github.com/ubie-oss/mcp-vertexai-search/sessions/6d944786-7dbd-4a74-b178-97c455b0eab1

Co-authored-by: yu-iskw <[email protected]>
@yu-iskw yu-iskw marked this pull request as ready for review April 17, 2026 05:03
@yu-iskw yu-iskw merged commit 7dcb74a into main Apr 17, 2026
5 checks passed
@yu-iskw yu-iskw deleted the copilot/remediate-supply-chain-vulnerabilities branch April 17, 2026 05:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants