mirror of
https://github.com/semantica-agi/semantica.git
synced 2026-08-29 04:26:20 +00:00
Mohd Kaif
c8519470bc
* security: fix 9 Dependabot/CodeQL alerts — DOMPurify, vite, uuid, workflow permissions - Add explicit permissions block to defender-for-devops.yml (CodeQL #25) - Upgrade vite 5.4.x → 6.4.3; bundled esbuild 0.21.5 → 0.25.12 (Dependabot #2, #7) - Force dompurify ^3.4.0 via npm overrides; resolves 6 DOMPurify XSS alerts (#4–#6, #8–#11) - Force uuid ^13.0.1 via npm overrides; fixes buffer bounds check (Dependabot #12) * fix(ci): exclude bandit from MSDO scan on windows-latest bandit_runner.exe builds a per-file command line; on a large Python repo the total command string exceeds the Windows CreateProcess limit and the process fails to start (Win32 ERROR_FILENAME_EXCED_RANGE 206). Exclude bandit via the tools param and retain checkov, eslint, templateanalyzer, terrascan, and binskim. * fix(ci): drop binskim (no binaries), enable Neptune audit logging - Remove binskim from MSDO tools: repo has no compiled binaries so BinSkim raises AnalyzeArgumentNoValuesException and breaks the run - Add EnableCloudwatchLogsExports: [audit] to NeptuneCluster to fix Checkov CKV_AWS_101 (the one error-level result breaking the build)