bvandeusen/thoughtsync
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 4 Wiki Activity

Security Dashboard #1

New Issue
Open
opened 2026-08-09 20:59:35 -04:00 by renovate-bot · 0 comments
renovate-bot commented 2026-08-09 20:59:35 -04:00
Copy Link
Copy Source

Automated weekly security sweep — last rewritten 2026-08-31 07:31 UTC (runs).

This issue is maintained like the Renovate Dependency Dashboard: every sweep run rewrites it in place. Don't edit findings here — fix them, or allowlist them with a written reason (this repo's .gitleaks.toml for secrets, an inline # nosemgrep: <rule-id> -- <reason> for code findings). There is no per-push security lane; this dashboard and the on-demand deep review are where security findings surface.

Secrets (gitleaks)

Clean — no findings.

Code findings (semgrep, curated family ruleset)

ERROR — believed-real on this family's code (3):

  • alembic/versions/0015_sync_revision.py:38 opt.security-rules.fabled-sql-string-interpolation — SQL built by string interpolation. This family is ORM-first; raw SQL assembled from an f-string bypasses parameter binding. Use bound parameters — text("... :id"), {"id": value} — not interpolation.
  • alembic/versions/0015_sync_revision.py:82 opt.security-rules.fabled-sql-string-interpolation — SQL built by string interpolation. This family is ORM-first; raw SQL assembled from an f-string bypasses parameter binding. Use bound parameters — text("... :id"), {"id": value} — not interpolation.
  • alembic/versions/0015_sync_revision.py:84 opt.security-rules.fabled-sql-string-interpolation — SQL built by string interpolation. This family is ORM-first; raw SQL assembled from an f-string bypasses parameter binding. Use bound parameters — text("... :id"), {"id": value} — not interpolation.
    WARNING — useful, precision not yet proven (1):
  • frontend/src/components/Icon.vue:46 opt.security-rules.fabled-vue-v-html — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i

Dependency CVEs (osv-scanner)

Published image (trivy)

  • HIGH CVE-2026-41992 — gzip 1.13-1 (no fix released)
  • HIGH CVE-2026-54369 — libacl1 2.3.2-2+b1 (no fix released)
  • HIGH CVE-2025-69720 — libncursesw6 6.5+20250216-2 (no fix released)
  • HIGH CVE-2026-11822 — libsqlite3-0 3.46.1-7+deb13u1 (no fix released)
  • HIGH CVE-2026-11824 — libsqlite3-0 3.46.1-7+deb13u1 (no fix released)
  • HIGH CVE-2026-14456 — libssl3t64 3.5.6-1~deb13u2 → fixed in 3.5.7-1~deb13u2
  • HIGH CVE-2025-69720 — libtinfo6 6.5+20250216-2 (no fix released)
  • HIGH CVE-2025-69720 — ncurses-base 6.5+20250216-2 (no fix released)
  • HIGH CVE-2025-69720 — ncurses-bin 6.5+20250216-2 (no fix released)
  • HIGH CVE-2026-14456 — openssl 3.5.6-1~deb13u2 → fixed in 3.5.7-1~deb13u2
  • HIGH CVE-2026-14456 — openssl-provider-legacy 3.5.6-1~deb13u2 → fixed in 3.5.7-1~deb13u2
  • CRITICAL CVE-2026-13221 — perl-base 5.40.1-6 (no fix released)
  • CRITICAL CVE-2026-42496 — perl-base 5.40.1-6 (no fix released)
  • CRITICAL CVE-2026-8376 — perl-base 5.40.1-6 (no fix released)
  • HIGH CVE-2026-42497 — perl-base 5.40.1-6 (no fix released)
  • HIGH CVE-2026-48962 — perl-base 5.40.1-6 (no fix released)
  • HIGH CVE-2026-57432 — perl-base 5.40.1-6 (no fix released)
  • HIGH CVE-2026-57433 — perl-base 5.40.1-6 (no fix released)
  • HIGH CVE-2026-9538 — perl-base 5.40.1-6 (no fix released)
    Totals for git.fabledsword.com/bvandeusen/thoughtsync:latest: 3 CRITICAL, 16 HIGH, 64 MEDIUM, 76 LOW, 7 UNKNOWN. Only CRITICAL/HIGH are itemized above.

Coverage & limits

  • All four scanners ran with nothing skipped.
<!-- fabledsentry-security-dashboard --> _Automated weekly security sweep — last rewritten 2026-08-31 07:31 UTC ([runs](https://git.fabledsword.com/bvandeusen/CI-runner/actions))._ This issue is maintained like the Renovate Dependency Dashboard: every sweep run rewrites it in place. Don't edit findings here — fix them, or allowlist them **with a written reason** (this repo's `.gitleaks.toml` for secrets, an inline `# nosemgrep: <rule-id> -- <reason>` for code findings). There is no per-push security lane; this dashboard and the on-demand deep review are where security findings surface. ## Secrets (gitleaks) Clean — no findings. ## Code findings (semgrep, curated family ruleset) **ERROR — believed-real on this family's code (3):** - `alembic/versions/0015_sync_revision.py:38` `opt.security-rules.fabled-sql-string-interpolation` — SQL built by string interpolation. This family is ORM-first; raw SQL assembled from an f-string bypasses parameter binding. Use bound parameters — text("... :id"), {"id": value} — not interpolation. - `alembic/versions/0015_sync_revision.py:82` `opt.security-rules.fabled-sql-string-interpolation` — SQL built by string interpolation. This family is ORM-first; raw SQL assembled from an f-string bypasses parameter binding. Use bound parameters — text("... :id"), {"id": value} — not interpolation. - `alembic/versions/0015_sync_revision.py:84` `opt.security-rules.fabled-sql-string-interpolation` — SQL built by string interpolation. This family is ORM-first; raw SQL assembled from an f-string bypasses parameter binding. Use bound parameters — text("... :id"), {"id": value} — not interpolation. **WARNING — useful, precision not yet proven (1):** - `frontend/src/components/Icon.vue:46` `opt.security-rules.fabled-vue-v-html` — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i ## Dependency CVEs (osv-scanner) - `atk 0.18.2` (crates.io, `Cargo.lock`): [RUSTSEC-2024-0413](https://osv.dev/vulnerability/RUSTSEC-2024-0413) - `atk-sys 0.18.2` (crates.io, `Cargo.lock`): [RUSTSEC-2024-0416](https://osv.dev/vulnerability/RUSTSEC-2024-0416) - `gdk 0.18.2` (crates.io, `Cargo.lock`): [RUSTSEC-2024-0412](https://osv.dev/vulnerability/RUSTSEC-2024-0412) - `gdk-sys 0.18.2` (crates.io, `Cargo.lock`): [RUSTSEC-2024-0418](https://osv.dev/vulnerability/RUSTSEC-2024-0418) - `gdkwayland-sys 0.18.2` (crates.io, `Cargo.lock`): [RUSTSEC-2024-0411](https://osv.dev/vulnerability/RUSTSEC-2024-0411) - `gdkx11 0.18.2` (crates.io, `Cargo.lock`): [RUSTSEC-2024-0417](https://osv.dev/vulnerability/RUSTSEC-2024-0417) - `gdkx11-sys 0.18.2` (crates.io, `Cargo.lock`): [RUSTSEC-2024-0414](https://osv.dev/vulnerability/RUSTSEC-2024-0414) - `glib 0.18.5` (crates.io, `Cargo.lock`): [GHSA-wrw7-89jp-8q8g](https://osv.dev/vulnerability/GHSA-wrw7-89jp-8q8g), [RUSTSEC-2024-0429](https://osv.dev/vulnerability/RUSTSEC-2024-0429) - `gtk 0.18.2` (crates.io, `Cargo.lock`): [RUSTSEC-2024-0415](https://osv.dev/vulnerability/RUSTSEC-2024-0415) - `gtk-sys 0.18.2` (crates.io, `Cargo.lock`): [RUSTSEC-2024-0420](https://osv.dev/vulnerability/RUSTSEC-2024-0420) - `gtk3-macros 0.18.2` (crates.io, `Cargo.lock`): [RUSTSEC-2024-0419](https://osv.dev/vulnerability/RUSTSEC-2024-0419) - `proc-macro-error 1.0.4` (crates.io, `Cargo.lock`): [RUSTSEC-2024-0370](https://osv.dev/vulnerability/RUSTSEC-2024-0370) - `unic-char-property 0.9.0` (crates.io, `Cargo.lock`): [RUSTSEC-2025-0081](https://osv.dev/vulnerability/RUSTSEC-2025-0081) - `unic-char-range 0.9.0` (crates.io, `Cargo.lock`): [RUSTSEC-2025-0075](https://osv.dev/vulnerability/RUSTSEC-2025-0075) - `unic-common 0.9.0` (crates.io, `Cargo.lock`): [RUSTSEC-2025-0080](https://osv.dev/vulnerability/RUSTSEC-2025-0080) - `unic-ucd-ident 0.9.0` (crates.io, `Cargo.lock`): [RUSTSEC-2025-0100](https://osv.dev/vulnerability/RUSTSEC-2025-0100) - `unic-ucd-version 0.9.0` (crates.io, `Cargo.lock`): [RUSTSEC-2025-0098](https://osv.dev/vulnerability/RUSTSEC-2025-0098) - `brace-expansion 2.1.2` (npm, `frontend/package-lock.json`): [GHSA-mh99-v99m-4gvg](https://osv.dev/vulnerability/GHSA-mh99-v99m-4gvg), [GHSA-rgw5-rvv9-x895](https://osv.dev/vulnerability/GHSA-rgw5-rvv9-x895) - `esbuild 0.21.5` (npm, `frontend/package-lock.json`): [GHSA-67mh-4wv8-2f99](https://osv.dev/vulnerability/GHSA-67mh-4wv8-2f99) - `nanoid 3.3.16` (npm, `frontend/package-lock.json`): [GHSA-2v37-7h3g-55p8](https://osv.dev/vulnerability/GHSA-2v37-7h3g-55p8) - `postcss 8.5.20` (npm, `frontend/package-lock.json`): [GHSA-fxqj-rqcc-2cmp](https://osv.dev/vulnerability/GHSA-fxqj-rqcc-2cmp) - `vite 5.4.21` (npm, `frontend/package-lock.json`): [GHSA-4w7w-66w2-5vf9](https://osv.dev/vulnerability/GHSA-4w7w-66w2-5vf9), [GHSA-fx2h-pf6j-xcff](https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff), [GHSA-v6wh-96g9-6wx3](https://osv.dev/vulnerability/GHSA-v6wh-96g9-6wx3) ## Published image (trivy) - **HIGH** CVE-2026-41992 — `gzip 1.13-1` (no fix released) - **HIGH** CVE-2026-54369 — `libacl1 2.3.2-2+b1` (no fix released) - **HIGH** CVE-2025-69720 — `libncursesw6 6.5+20250216-2` (no fix released) - **HIGH** CVE-2026-11822 — `libsqlite3-0 3.46.1-7+deb13u1` (no fix released) - **HIGH** CVE-2026-11824 — `libsqlite3-0 3.46.1-7+deb13u1` (no fix released) - **HIGH** CVE-2026-14456 — `libssl3t64 3.5.6-1~deb13u2` → fixed in 3.5.7-1~deb13u2 - **HIGH** CVE-2025-69720 — `libtinfo6 6.5+20250216-2` (no fix released) - **HIGH** CVE-2025-69720 — `ncurses-base 6.5+20250216-2` (no fix released) - **HIGH** CVE-2025-69720 — `ncurses-bin 6.5+20250216-2` (no fix released) - **HIGH** CVE-2026-14456 — `openssl 3.5.6-1~deb13u2` → fixed in 3.5.7-1~deb13u2 - **HIGH** CVE-2026-14456 — `openssl-provider-legacy 3.5.6-1~deb13u2` → fixed in 3.5.7-1~deb13u2 - **CRITICAL** CVE-2026-13221 — `perl-base 5.40.1-6` (no fix released) - **CRITICAL** CVE-2026-42496 — `perl-base 5.40.1-6` (no fix released) - **CRITICAL** CVE-2026-8376 — `perl-base 5.40.1-6` (no fix released) - **HIGH** CVE-2026-42497 — `perl-base 5.40.1-6` (no fix released) - **HIGH** CVE-2026-48962 — `perl-base 5.40.1-6` (no fix released) - **HIGH** CVE-2026-57432 — `perl-base 5.40.1-6` (no fix released) - **HIGH** CVE-2026-57433 — `perl-base 5.40.1-6` (no fix released) - **HIGH** CVE-2026-9538 — `perl-base 5.40.1-6` (no fix released) _Totals for `git.fabledsword.com/bvandeusen/thoughtsync:latest`: 3 CRITICAL, 16 HIGH, 64 MEDIUM, 76 LOW, 7 UNKNOWN. Only CRITICAL/HIGH are itemized above._ ## Coverage & limits - All four scanners ran with nothing skipped.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
bvandeusen
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: bvandeusen/thoughtsync#1