From 03b3282de473ccb074e5def1539cb3f0823d837e Mon Sep 17 00:00:00 2001 From: Yoshihito Aso Date: Thu, 22 Oct 2026 10:51:50 +0900 Subject: [PATCH 1/2] fix: update certifi for GHSA-6q48-6c7w-9gw2 (dev-26.3) --- pyproject.toml | 4 ++++ uv.lock | 9 ++++++--- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index 6be1346b3..1af597803 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -118,3 +118,7 @@ include = [ "batch/**/*", "cmd/**/*", ] + +[tool.uv] +# GHSA-6q48-6c7w-9gw2: require the fixed CA bundle. +constraint-dependencies = ["certifi>=2026.10.19"] diff --git a/uv.lock b/uv.lock index 5f9bb59bb..b50af32a1 100644 --- a/uv.lock +++ b/uv.lock @@ -2,6 +2,9 @@ version = 1 revision = 3 requires-python = "==3.13.11" +[manifest] +constraints = [{ name = "certifi", specifier = ">=2026.10.19" }] + [[package]] name = "aiohappyeyeballs" version = "2.6.1" @@ -652,11 +655,11 @@ wheels = [ [[package]] name = "certifi" -version = "2025.4.26" +version = "2026.10.19" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/e8/9e/c05b3920a3b7d20d3d3310465f50348e5b3694f4f88c6daf736eef3024c4/certifi-2025.4.26.tar.gz", hash = "sha256:0a816057ea3cdefcef70270d2c515e4506bbc954f417fa5ade2021213bb8f0c6", size = 160705, upload-time = "2025-04-26T02:12:29.51Z" } +sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/4a/7e/3db2bd1b1f9e95f7cddca6d6e75e2f2bd9f51b1246e546d88addca0106bd/certifi-2025.4.26-py3-none-any.whl", hash = "sha256:30350364dfe371162649852c63336a15c70c6510c2ad5015b21c2345311805f3", size = 159618, upload-time = "2025-04-26T02:12:27.662Z" }, + { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" }, ] [[package]] From 0a3523b1208fa49760bb6459f4a598a2dc7837ff Mon Sep 17 00:00:00 2001 From: Yoshihito Aso Date: Thu, 22 Oct 2026 11:00:07 +0900 Subject: [PATCH 2/2] fix: pin GitHub Actions to full commit SHAs --- .github/actions/setup-test-image/action.yml | 6 +++--- .github/workflows/build.yml | 8 +++---- .github/workflows/codeql-analysis.yml | 8 +++---- .github/workflows/pr.yml | 24 ++++++++++----------- 4 files changed, 23 insertions(+), 23 deletions(-) diff --git a/.github/actions/setup-test-image/action.yml b/.github/actions/setup-test-image/action.yml index 1601a5eac..238cb9bb0 100644 --- a/.github/actions/setup-test-image/action.yml +++ b/.github/actions/setup-test-image/action.yml @@ -3,15 +3,15 @@ description: 'Setup docker builder for using github actions cache' runs: using: "composite" steps: - - uses: docker/setup-buildx-action@v3 + - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 - name: Set metadata id: metadata - uses: docker/metadata-action@v5 + uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5 with: images: ibet-wallet-api tags: | type=sha,format=short - - uses: docker/build-push-action@v6 + - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 with: context: . file: ./tests/Dockerfile_unittest diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 712442ea3..37be36054 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -11,13 +11,13 @@ jobs: timeout-minutes: 60 steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4 - name: Login to GitHub Container Registry - uses: docker/login-action@v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 with: registry: ghcr.io username: ${{ github.repository_owner }} @@ -28,7 +28,7 @@ jobs: run: echo ::set-output name=VERSION::${GITHUB_REF/refs\/tags\//} - name: Build and Push (ibet-wallet) - uses: docker/build-push-action@v7 + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7 with: context: . file: Dockerfile diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 8dd91cfa1..ea0b860a3 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -24,19 +24,19 @@ jobs: timeout-minutes: 60 steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4 with: languages: ${{ matrix.language }} # Autobuild attempts to build any compiled languages (C/C++, C#, Go, or Java). - name: Autobuild - uses: github/codeql-action/autobuild@v4 + uses: github/codeql-action/autobuild@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index f9388dbf7..6384860cf 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -7,15 +7,15 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 60 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - uses: ./.github/actions/setup-test-image lint-ruff: name: "Lint check (ruff and pyright)" runs-on: ubuntu-latest timeout-minutes: 60 steps: - - uses: actions/checkout@v6 - - uses: astral-sh/ruff-action@v3 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 + - uses: astral-sh/ruff-action@4919ec5cf1f49eff0871dbcea0da843445b837e6 # v3 - name: Install uv uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 with: @@ -25,7 +25,7 @@ jobs: **/uv.lock - name: Restore cache id: cache-venv - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5 with: path: .venv key: venv-${{ runner.os }}-${{ hashFiles('**/pyproject.toml', '**/uv.lock') }} @@ -49,7 +49,7 @@ jobs: test_target: ["tests/app/", "tests/batch/"] timeout-minutes: 60 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - uses: ./.github/actions/setup-test-image - name: build image on compose run: docker compose build @@ -60,14 +60,14 @@ jobs: - name: run unit test using ${{ matrix.db }} run: docker compose run -e TEST_TARGET="${{ matrix.test_target }}" ibet-wallet-api-${{ matrix.db }} - run: mv cov/.coverage cov/.coverage-${{ strategy.job-index }} - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 if: matrix.db == 'postgres' with: name: .coverage-${{ strategy.job-index }} path: cov/.coverage-${{ strategy.job-index }} include-hidden-files: true - run: mv cov/pytest.xml cov/pytest-${{ strategy.job-index }}.xml - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 if: matrix.db == 'postgres' with: name: pytest-${{ strategy.job-index }} @@ -82,7 +82,7 @@ jobs: pull-requests: write timeout-minutes: 60 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - uses: ./.github/actions/setup-test-image - name: build image on compose run: docker compose build @@ -90,7 +90,7 @@ jobs: run: | sudo chown runner:docker /home/runner/work/ibet-Wallet-API/ibet-Wallet-API/cov sudo chmod 777 /home/runner/work/ibet-Wallet-API/ibet-Wallet-API/cov - - uses: actions/download-artifact@v8 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: pattern: ".coverage-*" path: cov/ @@ -99,12 +99,12 @@ jobs: run: docker compose run -w /app/ibet-Wallet-API/cov ibet-wallet-api-postgres bash --login -c 'uv run coverage combine .coverage-*' - name: generate coverage xml file run: docker compose run -w /app/ibet-Wallet-API ibet-wallet-api-postgres bash --login -c 'uv run coverage xml --data-file=cov/.coverage -o cov/coverage.xml' - - uses: actions/download-artifact@v8 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: pattern: "pytest-*" path: cov/ merge-multiple: true - - uses: actions/setup-node@v6 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 with: node-version: 20 - name: Install junit-report-merger @@ -139,7 +139,7 @@ jobs: db: [postgres, mysql] timeout-minutes: 60 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - uses: ./.github/actions/setup-test-image - name: run unit test using ${{ matrix.db }} run: docker compose run ibet-wallet-api-${{ matrix.db }} bash --login -c "cd /app/ibet-Wallet-API && uv run pytest -vv --test-alembic -m 'alembic'"