Skip to content

fix: security vulnerabilities + update GitHub Actions - #2035

Merged
kkedziak-splunk merged 30 commits into
developfrom
renovate/github-actions
Aug 21, 2026
Merged

fix: security vulnerabilities + update GitHub Actions#2035
kkedziak-splunk merged 30 commits into
developfrom
renovate/github-actions

Conversation

@renovate

@renovate renovate Bot commented Apr 26, 2026 •
edited by kkedziak-splunk
Loading

Copy link
Copy Markdown
Contributor

Summary

GitHub Actions updates (from Renovate)

  • splunk/addonfactory-test-matrix-action v3.1 → v3.3
  • splunk/appinspect-cli-action v2.13 → v2.15
  • Python version bumps reverted — not ready yet

Python security fix (VULN-87175, CVE-2026-7246 — click)

  • Drop splunk-appinspect from pyproject.toml; ucc-gen validate now shells out to the splunk-appinspect binary instead of importing it
  • Move mkdocs dependencies out of the main dev group into a standalone docs/requirements.txt + mkdocs.py helper
  • Removes the entire click / appinspect transitive chain from the default lock

JS security fixes

Test plan

  • CI docs job builds successfully with the new mkdocs.py approach
  • ucc-gen validate works end-to-end with splunk-appinspect installed separately
  • UI build and tests pass (yarn build, yarn test)

🤖 Generated with Claude Code

@renovate
renovate Bot requested a review from a team as a code owner April 26, 2026 02:39
@renovate
renovate Bot requested review from artemrys and mdobecki-splunk April 26, 2026 02:39
@renovate
renovate Bot force-pushed the renovate/github-actions branch from d7384cc to ac52246 Compare May 22, 2026 11:43
@renovate
renovate Bot force-pushed the renovate/github-actions branch from ac52246 to 336af6b Compare June 3, 2026 13:04
@github-actions
github-actions Bot requested a review from a team as a code owner June 3, 2026 13:07
@github-actions
github-actions Bot requested a review from soleksy-splunk June 3, 2026 13:07
@renovate
renovate Bot force-pushed the renovate/github-actions branch 3 times, most recently from 91e6fc7 to edd6097 Compare July 1, 2026 08:04
kkedziak-splunk and others added 19 commits July 31, 2026 14:20
@kkedziak-splunk @claude
chore(deps): drop splunk-appinspect and move mkdocs to optional docs …
531a7c4 
…group (VULN-87175)

splunk-appinspect was pulled in as a runtime optional extra so that
`ucc-gen validate` could import it. That single import chain dragged
click, lxml, and a long tail of transitive deps into the resolution
even though `main.validate` was only ever invoked as a CLI entry point.

Refactor `ucc-gen validate` to invoke the `splunk-appinspect` executable
via subprocess (equivalent to `splunk-appinspect inspect ...`) and drop
splunk-appinspect from pyproject.toml. Users of `ucc-gen validate` now
install `splunk-appinspect` separately (e.g. via pipx).

Also move mkdocs and its plugins into an optional `docs` poetry group.
They are only used by the docs CI job, which now runs
`poetry install --with docs`. This removes click from the default
resolution entirely.

Co-Authored-By: Claude <noreply@anthropic.com>
@kkedziak-splunk
Merge remote-tracking branch 'origin/main' into fix/vuln-click-lxml-a…
5712a4c 
…ppinspect-subprocess
@kkedziak-splunk
Merge remote-tracking branch 'origin/develop' into fix/vuln-click-lxm…
b6575de 
…l-appinspect-subprocess

# Conflicts:
#	poetry.lock
@kkedziak-splunk @claude
ci: replace removed [validate] extra with direct splunk-appinspect in…
57c0c5f 
…stall in build-test-addon job

The [validate] extra was removed together with the runtime dep. The
build-test-addon workflow installs splunk-appinspect separately so
`ucc-gen validate` can shell out to its binary.

Co-Authored-By: Claude <noreply@anthropic.com>
@srv-rr-github-token
update screenshots
f0dffc7
@kkedziak-splunk @claude
chore(deps): install mkdocs in a standalone venv, remove from pyproje…
05971e3 
…ct entirely

Marker-based scoping (e.g. python="^3.11") would not have helped because
poetry.lock always contains the full resolution graph regardless of
install-time markers, and dependency scanners read the lock file, not
the install manifest.

Instead, drop the [tool.poetry.group.docs] block entirely and install
mkdocs + its plugins in a throwaway venv in the docs GitHub Actions job.
mkdocstrings still needs the ucc package importable, so the venv also
`pip install .`s the current project.

This removes mkdocs (and click, which it pulled) from poetry.lock, so
FOSSA and dependabot no longer see them as project dependencies.

Co-Authored-By: Claude <noreply@anthropic.com>
@srv-rr-github-token
update screenshots
9ad0c7f
@kkedziak-splunk @claude
Merge branch 'develop' into fix/vuln-click-lxml-appinspect-subprocess
b42dcad 
Resolve poetry.lock conflict by keeping PR branch version (no mkdocs or
splunk-appinspect), consistent with the PR's intent to drop those deps.

Co-Authored-By: Claude <noreply@anthropic.com>
@kkedziak-splunk @claude
Merge branch 'develop' into fix/vuln-click-lxml-appinspect-subprocess
06084fe 
Conflict resolution:
- pyproject.toml: kept httplib2 addition from develop, dropped mkdocs packages (PR removed them from pyproject entirely)
- poetry.lock: took PR branch version, regenerated with `poetry lock` to incorporate httplib2

Co-Authored-By: Claude <noreply@anthropic.com>
@kkedziak-splunk @claude
Merge branch 'develop' into fix/vuln-click-lxml-appinspect-subprocess
2023e19 
Conflict resolution:
- pyproject.toml: kept httplib2 ^0.32.0 from develop, dropped mkdocs packages (PR removed them)
- poetry.lock: regenerated with `poetry lock` to match resolved pyproject.toml

Co-Authored-By: Claude <noreply@anthropic.com>
@kkedziak-splunk @claude
fix: address Codex review findings for security and docs correctness
83f8184 
- validate.py: reject splunk-appinspect executables resolved from the
  current working directory (Windows CWD injection via shutil.which)
- docs/requirements.txt: add pinned exact-version deps for docs tooling
- docs.yml: install docs tooling from pinned requirements.txt instead
  of unpinned ~= ranges (prevents compromised future PyPI release from
  running in the write-enabled Pages job)
- docs/contributing.md: update local docs preview instructions to use
  the standalone venv (poetry run mkdocs no longer works after mkdocs
  was removed from dev dependencies)

Co-Authored-By: Claude <noreply@anthropic.com>
@kkedziak-splunk @claude
docs: use pipx for local mkdocs preview in contributing guide
7debbdd 
Co-Authored-By: Claude <noreply@anthropic.com>
@kkedziak-splunk @claude
ci: pin splunk-appinspect to 4.3.0 in build-test-addon job
c49f8f0 
Unpinned installs execute unreviewed build code and can break silently
if a future release drops Python 3.9 or changes CLI behaviour.
4.3.0 matches what poetry.lock resolved before the package was removed
from pyproject.toml.

Co-Authored-By: Claude <noreply@anthropic.com>
@kkedziak-splunk @claude
fix(validate): compare unresolved parent path to close symlink bypass
ce4b7e9 
Using .resolve() on the binary path before comparing to CWD would follow
a symlink out of the directory, letting a planted CWD symlink bypass the
guard. Comparing the unresolved parent directory catches both a real
executable and a symlink in CWD without following the link target.

Co-Authored-By: Claude <noreply@anthropic.com>
@kkedziak-splunk @claude
chore(docs): pin all transitive dependencies in docs/requirements.txt
32d81b9 
Generated by installing the four direct deps in a clean venv and
capturing pip freeze, so every transitive package is now at an exact
version. Prevents a compromised future PyPI release from executing in
the write-enabled Pages job without a repository change.

Co-Authored-By: Claude <noreply@anthropic.com>
@kkedziak-splunk @claude
ci(docs): bump Python to 3.10 for docs venv
3328807 
click==8.4.2 (pulled in by mkdocs-material) requires Python >=3.10.
Python 3.9 is also EOL so this is an overdue bump.

Co-Authored-By: Claude <noreply@anthropic.com>
@srv-rr-github-token
update screenshots
91fe3a0
@kkedziak-splunk @claude
chore(docs): add mkdocs.sh helper script
95fd849 
Creates .docs-venv on first run (pinned deps from docs/requirements.txt),
then proxies all arguments to mkdocs. Both CI and local dev now use the
same single entry point.

Co-Authored-By: Claude <noreply@anthropic.com>
@srv-rr-github-token
update screenshots
f29c117
kkedziak-splunk and others added 7 commits August 19, 2026 16:22
@kkedziak-splunk @claude
chore(docs): remove incomplete venv on setup failure in mkdocs.sh
8dd5813 
A trap on ERR deletes .docs-venv if any install step fails, preventing
a partial venv from silently skipping setup on the next run.

Co-Authored-By: Claude <noreply@anthropic.com>
@kkedziak-splunk @claude
chore(docs): replace mkdocs.sh with mkdocs.py
ff2ca45 
Python script is cross-platform (handles Windows Scripts/ vs bin/) and
lets contributors pin the interpreter version explicitly, e.g.
`python3.10 mkdocs.py serve`.

Co-Authored-By: Claude <noreply@anthropic.com>
@srv-rr-github-token
update screenshots
cb29718
@kkedziak-splunk @claude
chore(docs): add license header to mkdocs.py and ignore .docs-venv
a675766 
Co-Authored-By: Claude <noreply@anthropic.com>
@srv-rr-github-token
update screenshots
e799101
@kkedziak-splunk @claude
fix: address JS security vulnerabilities CVE-2026-67213, CVE-2026-53666…
966cea6 
…/68/69

- Bump react-router-dom 6.30.4 → 6.30.5 (CVE-2026-53668); this also
  pulls react-router@6.30.5 transitively (CVE-2026-53666, CVE-2026-53669)
- Pin nanoid to 3.3.18 via yarn resolutions to fix CVE-2026-67213
  (transitive dep via stylelint → postcss)

Co-Authored-By: Claude <noreply@anthropic.com>
@renovate
chore(deps): update github-actions
12778b8
@renovate
renovate Bot force-pushed the renovate/github-actions branch from fa6c630 to 12778b8 Compare August 21, 2026 07:49
kkedziak-splunk and others added 3 commits August 21, 2026 09:54
@kkedziak-splunk @claude
chore(deps): update github-actions (keep python versions, bump action…
83390b2 
… versions)

- splunk/addonfactory-test-matrix-action v3.1 → v3.3
- splunk/appinspect-cli-action v2.13 → v2.15
- Reverted python-version bumps (3.14 not ready yet)

Co-Authored-By: Claude <noreply@anthropic.com>
@kkedziak-splunk
Merge remote-tracking branch 'origin/fix/vuln-click-lxml-appinspect-s…
b3d3711 
…ubprocess' into renovate/github-actions
@kkedziak-splunk
Merge branch 'fix/security-cve-js-deps-2026-08' into renovate/github-…
c1b286a 
…actions
@kkedziak-splunk
kkedziak-splunk requested a review from a team as a code owner August 21, 2026 07:54
@pull-request-size pull-request-size Bot added size/L and removed size/S labels Aug 21, 2026
@kkedziak-splunk kkedziak-splunk changed the title chore(deps): update github-actions fix: security vulnerabilities + update GitHub Actions Aug 21, 2026
This was referenced Aug 21, 2026
Merged
Closed
@renovate

renovate Bot commented Aug 21, 2026

Copy link
Copy Markdown
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@github-actions

github-actions Bot commented Aug 21, 2026

Copy link
Copy Markdown

Code Coverage 🎉

Type PR Develop Change Status
Line Coverage 94.45% 94.37% 0.08% 🟢 Increased
Branch Coverage 90.75% 90.71% 0.04% 🟢 Increased

@kkedziak-splunk
kkedziak-splunk force-pushed the renovate/github-actions branch from cdf2d01 to 647b64e Compare August 21, 2026 08:06
@pull-request-size pull-request-size Bot added size/M and removed size/L labels Aug 21, 2026
@kkedziak-splunk
kkedziak-splunk enabled auto-merge (squash) August 21, 2026 08:30
@kkedziak-splunk
kkedziak-splunk merged commit 068007d into develop Aug 21, 2026
90 of 91 checks passed
@kkedziak-splunk
kkedziak-splunk deleted the renovate/github-actions branch August 21, 2026 08:33
@github-actions github-actions Bot locked and limited conversation to collaborators Aug 21, 2026
@github-actions github-actions Bot locked and limited conversation to collaborators Aug 21, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@kkedziak-splunk kkedziak-splunk kkedziak-splunk approved these changes
@artemrys artemrys Awaiting requested review from artemrys artemrys is a code owner automatically assigned from splunk/ucc-developers
@mdobecki-splunk mdobecki-splunk Awaiting requested review from mdobecki-splunk mdobecki-splunk is a code owner automatically assigned from splunk/ucc-developers
@soleksy-splunk soleksy-splunk Awaiting requested review from soleksy-splunk soleksy-splunk is a code owner automatically assigned from splunk/ucc-ui-developers

Assignees

No one assigned

Labels

size/M

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@kkedziak-splunk @srv-rr-github-token