From 2c5e20046b299fa244cfd82cd441859d3ec29c8a Mon Sep 17 00:00:00 2001 From: Mihir Rawool Date: Tue, 27 Oct 2026 19:24:47 +0530 Subject: [PATCH] LTS-5442: pin Semgrep image digest and patch brace-expansion - LTS-5529: pull returntocorp/semgrep:1.166.0 by its immutable digest (sha256:c180f0c9...) so a re-pushed tag cannot swap the SAST image. The Actions steps in the same workflow were already SHA-pinned. - LTS-5524: bump the brace-expansion override from 2.1.4 to 2.1.7, the first version outside the GHSA-qhr7-859c-m2p7 / GHSA-6j4f-fj2g-mc7p range (2.0.0 - 2.1.6). Lockfile change is limited to brace-expansion. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/Semgrep.yml | 2 +- package-lock.json | 16 ++++++++-------- package.json | 2 +- 3 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/Semgrep.yml b/.github/workflows/Semgrep.yml index e857756..17ceac4 100644 --- a/.github/workflows/Semgrep.yml +++ b/.github/workflows/Semgrep.yml @@ -27,7 +27,7 @@ jobs: container: # A Docker image with Semgrep installed. Do not change this. - image: returntocorp/semgrep:1.166.0 + image: returntocorp/semgrep:1.166.0@sha256:c180f0c93a17b420c0af5006214a29d3c747c5459c732b740191adf657dd0068 # Skip any PR created by dependabot to avoid permission issues: if: (github.actor != 'dependabot[bot]') diff --git a/package-lock.json b/package-lock.json index cad7938..a7feaa9 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1448,9 +1448,9 @@ } }, "node_modules/brace-expansion": { - "version": "2.1.4", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", - "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", + "version": "2.1.7", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz", + "integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==", "dev": true, "license": "MIT", "dependencies": { @@ -7192,9 +7192,9 @@ } }, "brace-expansion": { - "version": "2.1.4", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", - "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", + "version": "2.1.7", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz", + "integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==", "dev": true, "requires": { "balanced-match": "^1.0.0" @@ -9072,7 +9072,7 @@ "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==", "dev": true, "requires": { - "brace-expansion": "2.1.4" + "brace-expansion": "2.1.7" } }, "minimist": { @@ -9606,7 +9606,7 @@ "integrity": "sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==", "dev": true, "requires": { - "brace-expansion": "2.1.4" + "brace-expansion": "2.1.7" } } } diff --git a/package.json b/package.json index 4b5d1b3..66c1f77 100644 --- a/package.json +++ b/package.json @@ -20,7 +20,7 @@ "fast-uri": "^3.1.6", "js-yaml@3": "^3.15.2", "js-yaml@4": "^4.3.2", - "brace-expansion": "2.1.4", + "brace-expansion": "2.1.7", "socks": "2.8.9", "ip-address": "10.4.0", "tmp": "0.2.7",