rbrooks/Iris-WLED
Watch
1
0
Fork
You've already forked Iris-WLED
 0
Code Issues 38 Pull requests Projects Releases 4 Packages 1 Wiki Activity Actions

🔒 Automated security scan findings #193

New issue
Open
opened 2026-10-29 07:07:46 +00:00 by renovate-bot · 0 comments
renovate-bot commented 2026-10-29 07:07:46 +00:00
Contributor
Copy link

Automated security scan

Filed by the fleet security scanner (.forgejo/workflows/security-scan.yml). Re-runs update this issue.

📦 git.rhoving.com/rbrooks/iris-wled:main (14 CVEs)

CVE Severity Package Installed Fixed
CVE-2026-96760 CRITICAL Authlib 1.7.2 1.9.0
GHSA-6q48-6c7w-9gw2 CRITICAL certifi 2026.6.17 2026.10.18
CVE-2026-111064 HIGH aiohttp 3.14.3 3.14.4
CVE-2026-111066 HIGH aiohttp 3.14.3 3.14.4
CVE-2026-114615 HIGH Authlib 1.7.2 1.9.0
CVE-2026-114616 HIGH Authlib 1.7.2 1.9.1
CVE-2026-116672 HIGH Authlib 1.7.2 1.9.1
CVE-2026-119283 HIGH joserfc 1.7.3 1.7.5
CVE-2026-69247 HIGH cryptography 49.0.0 50.0.0
CVE-2026-76844 HIGH zlib1g 1:1.3.dfsg+really1.3.1-1+b1 1:1.3.dfsg+really1.3.1-1+deb13u1
CVE-2026-85091 HIGH zlib1g 1:1.3.dfsg+really1.3.1-1+b1 1:1.3.dfsg+really1.3.1-1+deb13u1
CVE-2026-97687 HIGH urllib3 2.7.0 2.8.0
CVE-2026-97689 HIGH urllib3 2.7.0 2.8.0
GHSA-2g87-pp6c-29x5 HIGH aiohttp 3.14.3 3.14.4

📦 git.rhoving.com/rbrooks/iris-wled:latest (14 CVEs)

CVE Severity Package Installed Fixed
CVE-2026-96760 CRITICAL Authlib 1.7.2 1.9.0
GHSA-6q48-6c7w-9gw2 CRITICAL certifi 2026.6.17 2026.10.18
CVE-2026-103111 HIGH libpcre2-8-0 10.46-1~deb13u2 10.46-1~deb13u3
CVE-2026-109518 HIGH apt 3.0.3 3.0.4
CVE-2026-114615 HIGH Authlib 1.7.2 1.9.0
CVE-2026-114616 HIGH Authlib 1.7.2 1.9.1
CVE-2026-116672 HIGH Authlib 1.7.2 1.9.1
CVE-2026-119283 HIGH joserfc 1.7.3 1.7.5
CVE-2026-69247 HIGH cryptography 49.0.0 50.0.0
CVE-2026-76844 HIGH zlib1g 1:1.3.dfsg+really1.3.1-1+b1 1:1.3.dfsg+really1.3.1-1+deb13u1
CVE-2026-84782 HIGH libssl3t64 3.5.7-1~deb13u2 3.5.7-1~deb13u3
CVE-2026-85091 HIGH zlib1g 1:1.3.dfsg+really1.3.1-1+b1 1:1.3.dfsg+really1.3.1-1+deb13u1
CVE-2026-97687 HIGH urllib3 2.7.0 2.8.0
CVE-2026-97689 HIGH urllib3 2.7.0 2.8.0

📦 git.rhoving.com/rbrooks/iris-wled:sha-b3cf028 (14 CVEs)

CVE Severity Package Installed Fixed
CVE-2026-96760 CRITICAL Authlib 1.7.2 1.9.0
GHSA-6q48-6c7w-9gw2 CRITICAL certifi 2026.6.17 2026.10.18
CVE-2026-111064 HIGH aiohttp 3.14.3 3.14.4
CVE-2026-111066 HIGH aiohttp 3.14.3 3.14.4
CVE-2026-114615 HIGH Authlib 1.7.2 1.9.0
CVE-2026-114616 HIGH Authlib 1.7.2 1.9.1
CVE-2026-116672 HIGH Authlib 1.7.2 1.9.1
CVE-2026-119283 HIGH joserfc 1.7.3 1.7.5
CVE-2026-69247 HIGH cryptography 49.0.0 50.0.0
CVE-2026-76844 HIGH zlib1g 1:1.3.dfsg+really1.3.1-1+b1 1:1.3.dfsg+really1.3.1-1+deb13u1
CVE-2026-85091 HIGH zlib1g 1:1.3.dfsg+really1.3.1-1+b1 1:1.3.dfsg+really1.3.1-1+deb13u1
CVE-2026-97687 HIGH urllib3 2.7.0 2.8.0
CVE-2026-97689 HIGH urllib3 2.7.0 2.8.0
GHSA-2g87-pp6c-29x5 HIGH aiohttp 3.14.3 3.14.4
<!-- fleet-security-scan --> ## Automated security scan Filed by the fleet security scanner (`.forgejo/workflows/security-scan.yml`). Re-runs update this issue. ### 📦 `git.rhoving.com/rbrooks/iris-wled:main` (14 CVEs) | CVE | Severity | Package | Installed | Fixed | |-----|----------|---------|-----------|-------| | CVE-2026-96760 | CRITICAL | `Authlib` | 1.7.2 | 1.9.0 | | GHSA-6q48-6c7w-9gw2 | CRITICAL | `certifi` | 2026.6.17 | 2026.10.18 | | CVE-2026-111064 | HIGH | `aiohttp` | 3.14.3 | 3.14.4 | | CVE-2026-111066 | HIGH | `aiohttp` | 3.14.3 | 3.14.4 | | CVE-2026-114615 | HIGH | `Authlib` | 1.7.2 | 1.9.0 | | CVE-2026-114616 | HIGH | `Authlib` | 1.7.2 | 1.9.1 | | CVE-2026-116672 | HIGH | `Authlib` | 1.7.2 | 1.9.1 | | CVE-2026-119283 | HIGH | `joserfc` | 1.7.3 | 1.7.5 | | CVE-2026-69247 | HIGH | `cryptography` | 49.0.0 | 50.0.0 | | CVE-2026-76844 | HIGH | `zlib1g` | 1:1.3.dfsg+really1.3.1-1+b1 | 1:1.3.dfsg+really1.3.1-1+deb13u1 | | CVE-2026-85091 | HIGH | `zlib1g` | 1:1.3.dfsg+really1.3.1-1+b1 | 1:1.3.dfsg+really1.3.1-1+deb13u1 | | CVE-2026-97687 | HIGH | `urllib3` | 2.7.0 | 2.8.0 | | CVE-2026-97689 | HIGH | `urllib3` | 2.7.0 | 2.8.0 | | GHSA-2g87-pp6c-29x5 | HIGH | `aiohttp` | 3.14.3 | 3.14.4 | ### 📦 `git.rhoving.com/rbrooks/iris-wled:latest` (14 CVEs) | CVE | Severity | Package | Installed | Fixed | |-----|----------|---------|-----------|-------| | CVE-2026-96760 | CRITICAL | `Authlib` | 1.7.2 | 1.9.0 | | GHSA-6q48-6c7w-9gw2 | CRITICAL | `certifi` | 2026.6.17 | 2026.10.18 | | CVE-2026-103111 | HIGH | `libpcre2-8-0` | 10.46-1~deb13u2 | 10.46-1~deb13u3 | | CVE-2026-109518 | HIGH | `apt` | 3.0.3 | 3.0.4 | | CVE-2026-114615 | HIGH | `Authlib` | 1.7.2 | 1.9.0 | | CVE-2026-114616 | HIGH | `Authlib` | 1.7.2 | 1.9.1 | | CVE-2026-116672 | HIGH | `Authlib` | 1.7.2 | 1.9.1 | | CVE-2026-119283 | HIGH | `joserfc` | 1.7.3 | 1.7.5 | | CVE-2026-69247 | HIGH | `cryptography` | 49.0.0 | 50.0.0 | | CVE-2026-76844 | HIGH | `zlib1g` | 1:1.3.dfsg+really1.3.1-1+b1 | 1:1.3.dfsg+really1.3.1-1+deb13u1 | | CVE-2026-84782 | HIGH | `libssl3t64` | 3.5.7-1~deb13u2 | 3.5.7-1~deb13u3 | | CVE-2026-85091 | HIGH | `zlib1g` | 1:1.3.dfsg+really1.3.1-1+b1 | 1:1.3.dfsg+really1.3.1-1+deb13u1 | | CVE-2026-97687 | HIGH | `urllib3` | 2.7.0 | 2.8.0 | | CVE-2026-97689 | HIGH | `urllib3` | 2.7.0 | 2.8.0 | ### 📦 `git.rhoving.com/rbrooks/iris-wled:sha-b3cf028` (14 CVEs) | CVE | Severity | Package | Installed | Fixed | |-----|----------|---------|-----------|-------| | CVE-2026-96760 | CRITICAL | `Authlib` | 1.7.2 | 1.9.0 | | GHSA-6q48-6c7w-9gw2 | CRITICAL | `certifi` | 2026.6.17 | 2026.10.18 | | CVE-2026-111064 | HIGH | `aiohttp` | 3.14.3 | 3.14.4 | | CVE-2026-111066 | HIGH | `aiohttp` | 3.14.3 | 3.14.4 | | CVE-2026-114615 | HIGH | `Authlib` | 1.7.2 | 1.9.0 | | CVE-2026-114616 | HIGH | `Authlib` | 1.7.2 | 1.9.1 | | CVE-2026-116672 | HIGH | `Authlib` | 1.7.2 | 1.9.1 | | CVE-2026-119283 | HIGH | `joserfc` | 1.7.3 | 1.7.5 | | CVE-2026-69247 | HIGH | `cryptography` | 49.0.0 | 50.0.0 | | CVE-2026-76844 | HIGH | `zlib1g` | 1:1.3.dfsg+really1.3.1-1+b1 | 1:1.3.dfsg+really1.3.1-1+deb13u1 | | CVE-2026-85091 | HIGH | `zlib1g` | 1:1.3.dfsg+really1.3.1-1+b1 | 1:1.3.dfsg+really1.3.1-1+deb13u1 | | CVE-2026-97687 | HIGH | `urllib3` | 2.7.0 | 2.8.0 | | CVE-2026-97689 | HIGH | `urllib3` | 2.7.0 | 2.8.0 | | GHSA-2g87-pp6c-29x5 | HIGH | `aiohttp` | 3.14.3 | 3.14.4 |
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
renovate/lock-file-maintenance
release/1.1.x
v1.1.2
v1.1.1
v1.1.0
v1.0.0
Labels
Clear labels   
area/ai
AI suggestion pipeline

  
area/backend
FastAPI / Python backend

  
area/frontend
React / Vite frontend

  
area/infra
Docker, deployment, and infrastructure

  
area/scheduler
Scheduler and time envelope

  
area/wled
WLED controller integration

  
good-first-issue
Good for newcomers

  
priority/high
Blocks release or high impact

  
priority/low
Nice to have

  
priority/medium
Should be done soon

  
security
Security hardening / vulnerability work

  
type/bug
Something isn't working

  
type/chore
Maintenance, release, or housekeeping

  
type/ci-cd
CI/CD pipeline, build, or release automation

  
type/docs
Documentation

  
type/feature
New capability or enhancement

  
type/qa
Testing, validation, or quality assurance

  
v1.0.0
Target release: v1.0.0

  
v1.1.0
Target release: v1.1.0

  
v1.2.0
Target release: v1.2.0

  
v2.0.0
Target release: v2.0.0

No labels
area/ai
area/backend
area/frontend
area/infra
area/scheduler
area/wled
good-first-issue
priority/high
priority/low
priority/medium
security
type/bug
type/chore
type/ci-cd
type/docs
type/feature
type/qa
v1.0.0
v1.1.0
v1.2.0
v2.0.0
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
rbrooks/Iris-WLED#193
No description provided.