mirror of
https://github.com/semantica-agi/semantica.git
synced 2026-09-13 04:04:09 +00:00
Mohd Kaif
96dbd3f0d4
Dependabot flagged 12 aiohttp advisories (1 high, rest moderate/low - CVE range covering request smuggling, websocket/parser bugs, cookie/redirect issues) against aiohttp==3.13.5 pinned in checkov.txt. checkov==3.3.1 itself pinned `aiohttp<3.14.0`, which excludes every fixed release; 3.3.16 (latest) relaxes that to `<3.15.0`, so bumping checkov also lets aiohttp resolve to 3.14.3 (fixes all of them). Two alerts remain open, both genuinely blocked upstream rather than something a version bump here can fix: - asteval: checkov 3.3.16 (latest, still) hard-pins asteval==1.0.6 with no range; the fix (1.0.9) is unresolvable without violating checkov's own declared dependency - confirmed via `uv pip compile` refusing to solve it. Needs checkov itself to bump the pin upstream. - ecdsa: 0.19.2 is already the latest release; the Minerva timing-attack advisory has no patched version, since python-ecdsa's maintainers have stated side-channel attacks are out of scope for the project. Both are checkov's own transitive deps, used only for local static IaC analysis in defender-for-devops.yml (no network signing/cloud-auth calls that would actually exercise ecdsa's signing path) - dismissing on GitHub with that reasoning as a separate step.