You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
mise run security — the task the pre-push hook runs (hooks:pre-push:security) — has a
failing leg that nobody has seen, because the aggregate stops at the first failure and security:sast:masking (4th of 8) fails first. Running the legs individually exposes it:
MISE_EXPERIMENTAL=1 mise //agent:security → rc=1, at its security:image step. bandit
passes ("No issues identified"). Trivy reports 14 HIGH/CRITICAL fixable vulnerabilities, none
of them in this repo's own source, and none in the Debian base (debian 13.7 → 0 findings).
Measured 2026-09-15 on fix/879-insecure-object-assign @ a382fca2 (a merge of main 25330c72), mise 2026.9.9, trivy 0.70.0. That branch's diff vs main is two files, both under cdk/ — zero files under agent/ or any Dockerfile — so the image inputs are byte-identical
to main and this is a main-state finding, not a PR regression.
--ignore-unfixed means every one of these has a published fix. They are not
wait-for-upstream noise.
Proposed remedies
Per target, because they are three different kinds of problem:
gh — bump ARG GH_VERSION past 2.93.0 to a release whose go.mod carries the fixed golang.org/x/*, grpc, and rekor versions, and confirm by re-scanning rather than by
changelog. Because the binary is compiled from source in-image (go install …@vX), the vendored
set is whatever that tag pins — a version bump is the only lever; there is no separate dep file
to patch.
uv — bump the pinned digest to ≥ 0.11.15 (ghcr.io/astral-sh/uv:0.11.15@sha256:…).
Smallest, most mechanical fix of the three.
npm's bundled deps — npm@latest already ships them, so there is nothing to bump. The repo
already has a precedent for exactly this at agent/Dockerfile:92
(npm --prefix "${CLAUDE_NPM_ROOT}" update tar minimatch glob cross-spawn picomatch for the
claude-code tree). Extending that treatment to npm's own node_modules, or dropping targeted .trivyignore entries with an expiry and a linked upstream issue (the lifecycle feat(agent): CVE suppression lifecycle — scheduled re-scan of .grype.yaml ignores #131 asks
for), are the two honest options.
Acceptance criteria
MISE_EXPERIMENTAL=1 mise //agent:security exits 0 on main.
Any residual suppression lives in .trivyignore with a justification, an upstream link, and
an expiry date — not a blanket severity downgrade.
A regression note records that mise run security's short-circuit hides later legs, so future
"the security gate passes" claims are made leg-by-leg.
Summary
mise run security— the task the pre-push hook runs (hooks:pre-push:security) — has afailing leg that nobody has seen, because the aggregate stops at the first failure and
security:sast:masking(4th of 8) fails first. Running the legs individually exposes it:MISE_EXPERIMENTAL=1 mise //agent:security→ rc=1, at itssecurity:imagestep.banditpasses ("No issues identified"). Trivy reports 14 HIGH/CRITICAL fixable vulnerabilities, none
of them in this repo's own source, and none in the Debian base (
debian 13.7→ 0 findings).Measured 2026-09-15 on
fix/879-insecure-object-assign@a382fca2(a merge ofmain25330c72), mise 2026.9.9, trivy 0.70.0. That branch's diff vsmainis two files, both undercdk/— zero files underagent/or anyDockerfile— so the image inputs are byte-identicalto
mainand this is amain-state finding, not a PR regression.Scanner invocation (from
agent/mise.toml):Findings, grouped by what actually ships them
usr/local/bin/ghagent/Dockerfile:2ARG GH_VERSION=2.93.0, built from source in thegh-builderstage (line 27)usr/local/bin/uvagent/Dockerfile:99COPY --from=ghcr.io/astral-sh/uv:0.11.14@sha256:1025398…usr/lib/node_modules/npm/**agent/Dockerfile:89npm install -g npm@latest— npm's own bundled depsgh2.93.0 — vendored Go modules (9)github.com/sigstore/rekorgolang.org/x/cryptogolang.org/x/modgolang.org/x/netgolang.org/x/textgoogle.golang.org/grpcuv0.11.14 (1)quinn-protonpm's bundled dependencies (4)
brace-expansionip-addresstarWhy this has stayed invisible
Three independent reasons, which is why it needs its own issue rather than a note on an existing one:
mise run securityrunssecurity:secrets→deps→sast→sast:masking→grype→retire→gh-actions→//agent:security. Whole-reposast:maskingis red onmain(6 pre-existing findings, chore(security): clean up 21 pre-existing silent-success-masking findings on main #756/25 pre-existing masking findings on main fail the pre-push gate, forcing --no-verify for every contributor #766), so execution never reachesthe last leg. The practical consequence: "fix the masking findings and pre-push goes green" is
false — the next wall is this one.
build.ymlsetsMISE_DISABLE_TOOLS: "aqua:aquasecurity/trivy,grype,semgrep", and image scanning happens only inthe weekly
security.ymlcron. So PR checks are 8/8 green with these 14 live.--ignore-unfixedmeans every one of these has a published fix. They are notwait-for-upstream noise.
Proposed remedies
Per target, because they are three different kinds of problem:
gh— bumpARG GH_VERSIONpast 2.93.0 to a release whosego.modcarries the fixedgolang.org/x/*,grpc, andrekorversions, and confirm by re-scanning rather than bychangelog. Because the binary is compiled from source in-image (
go install …@vX), the vendoredset is whatever that tag pins — a version bump is the only lever; there is no separate dep file
to patch.
uv— bump the pinned digest to ≥ 0.11.15 (ghcr.io/astral-sh/uv:0.11.15@sha256:…).Smallest, most mechanical fix of the three.
npm@latestalready ships them, so there is nothing to bump. The repoalready has a precedent for exactly this at
agent/Dockerfile:92(
npm --prefix "${CLAUDE_NPM_ROOT}" update tar minimatch glob cross-spawn picomatchfor theclaude-code tree). Extending that treatment to npm's own
node_modules, or dropping targeted.trivyignoreentries with an expiry and a linked upstream issue (the lifecycle feat(agent): CVE suppression lifecycle — scheduled re-scan of .grype.yaml ignores #131 asksfor), are the two honest options.
Acceptance criteria
MISE_EXPERIMENTAL=1 mise //agent:securityexits 0 onmain..trivyignorewith a justification, an upstream link, andan expiry date — not a blanket severity downgrade.
mise run security's short-circuit hides later legs, so future"the security gate passes" claims are made leg-by-leg.
Related
MISE_DISABLE_TOOLS+ weekly-only cadence)with the scanner version, so pin before treating any number as a baseline)