4.7.1: bot pins certifi 2025.11.12 (GHSA-6q48-6c7w-9gw2, critical) #1343

New issue

Closed

opened 2026-11-06 01:33:27 +00:00 by claude-bot · 2 comments

claude-bot commented

2026-11-06 01:33:27 +00:00

Collaborator

A trivy scan of the published 4.7.0 images (2026-11-06; HIGH and CRITICAL, fixable only) found exactly one issue: the bot image has certifi 2025.11.12. GHSA-6q48-6c7w-9gw2 (critical): certifi bundles emSign root CAs whose intermediate CA keys were compromised. Fixed in 2026.10.18. The backend already has 2026.10.23, and the backend's Debian packages and the frontend's Alpine packages are clean.

Background: #132's last scan covered 4.7.0-rc3 and the older :latest. Its apt, libexpat, curl, brotli and pypdf findings are already fixed in 4.7.0.

Fix: bot/requirements.txt → certifi==2026.10.23. It's transitive (via httpx and httpcore), which is likely why Renovate didn't move it. Ship as 4.7.1, fixes only; the owner agreed on 2026-11-06. Prod goes only on the owner's say.

A trivy scan of the published 4.7.0 images (2026-11-06; HIGH and CRITICAL, fixable only) found exactly one issue: the **bot** image has `certifi` 2025.11.12. GHSA-6q48-6c7w-9gw2 (critical): certifi bundles emSign root CAs whose intermediate CA keys were compromised. Fixed in 2026.10.18. The backend already has 2026.10.23, and the backend's Debian packages and the frontend's Alpine packages are clean. Background: #132's last scan covered `4.7.0-rc3` and the older `:latest`. Its apt, libexpat, curl, brotli and pypdf findings are already fixed in 4.7.0. **Fix:** `bot/requirements.txt` → `certifi==2026.10.23`. It's transitive (via httpx and httpcore), which is likely why Renovate didn't move it. Ship as 4.7.1, fixes only; the owner agreed on 2026-11-06. Prod goes only on the owner's say.

rbrooks referenced this issue from a commit

2026-11-06 01:33:38 +00:00

fix(bot): certifi 2026.10.23 (GHSA-6q48-6c7w-9gw2)

claude-bot referenced this issue from a pull request that will close it,

2026-11-06 01:33:42 +00:00

fix(bot): certifi 2026.10.23 (GHSA-6q48-6c7w-9gw2), for 4.7.1 #1344

claude-bot closed this issue

2026-11-06 02:09:22 +00:00

rbrooks referenced this issue from a commit

2026-11-06 02:10:34 +00:00

chore(release): v4.7.1-rc1

claude-bot referenced this issue

2026-11-06 02:10:40 +00:00

chore(release): v4.7.1-rc1 #1349

claude-bot commented

2026-11-06 04:50:11 +00:00

Author

Collaborator

Fixed in 4.7.1-rc1, which is on dev (2026-11-06 04:47 UTC).

Merged in #1344, released through #1349 and the v4.7.1-rc1 tag.
The dev bot reports certifi 2026.10.23.
trivy image --severity HIGH,CRITICAL --ignore-unfixed on the published quest-board-bot:4.7.1-rc1 finds 0 findings.
On dev, every service is healthy, /api/meta returns 4.7.1-rc1, and the logs are clean. I took a backup before the update.

Next: the final 4.7.1, then prod on the owner's say.

**Fixed in 4.7.1-rc1, which is on dev (2026-11-06 04:47 UTC).** - Merged in #1344, released through #1349 and the `v4.7.1-rc1` tag. - The dev bot reports `certifi 2026.10.23`. - `trivy image --severity HIGH,CRITICAL --ignore-unfixed` on the published `quest-board-bot:4.7.1-rc1` finds **0 findings**. - On dev, every service is healthy, `/api/meta` returns `4.7.1-rc1`, and the logs are clean. I took a backup before the update. Next: the final 4.7.1, then prod on the owner's say.

rbrooks referenced this issue from a commit

2026-11-06 07:11:47 +00:00

chore(release): v4.7.1

claude-bot referenced this issue

2026-11-06 07:11:51 +00:00

chore(release): v4.7.1 #1350

claude-bot commented

2026-11-06 08:26:56 +00:00

Author

Collaborator

Released and on prod (2026-11-06 08:23 UTC, on the owner's say).

v4.7.1 was released through #1350 and the v4.7.1 tag. The release page and all three images are published.
On prod: I took a backup first (questboard_manual_20261106T082230Z.dump), then checked out the tag, pulled and ran up -d.
Every service is healthy and /api/meta returns 4.7.1.
The bot reports certifi 2026.10.23.
Alembic is unchanged at a1257b0c1d2e, since 4.7.1 has no migration.
The logs since the restart show no errors.

Closing.

**Released and on prod (2026-11-06 08:23 UTC, on the owner's say).** - v4.7.1 was released through #1350 and the `v4.7.1` tag. The release page and all three images are published. - On prod: I took a backup first (`questboard_manual_20261106T082230Z.dump`), then checked out the tag, pulled and ran `up -d`. - Every service is healthy and `/api/meta` returns `4.7.1`. - The bot reports `certifi 2026.10.23`. - Alembic is unchanged at `a1257b0c1d2e`, since 4.7.1 has no migration. - The logs since the restart show no errors. Closing.

claude-bot referenced this issue

2026-11-06 21:05:31 +00:00

🔒 Automated security scan findings #132