Conversation
* Update contact link in README.md * security: dependabot cooldowns * Deps: bump GitHub Actions - actions/checkout 6 -> 7 (#456) - actions/setup-python 6 -> 6.2.0 (#455) - ruby/setup-ruby 1 -> 1.313.0 (#453) - aws-actions/amazon-ecr-login 2 -> 2.1.5 (#448) - aws-actions/configure-aws-credentials 6 -> 6.1.3 (#446) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Deps: bump Ruby gems Majors (reviewed + suite passing): - puma 7.2.0 -> 8.0.2 (#435) - grape 2.4.0 -> 3.3.0 (#418) - brakeman 7.1.2 -> 8.0.5 (#411) Minor/patch: - view_component 4.6.0 -> 4.12.0 (#421) - selenium-webdriver 4.41.0 -> 4.45.0 (#416) - aws-sdk-s3 1.218.0 -> 1.226.0 (#434) - aws-sdk-lambda 1.176.0 -> 1.185.0 (#431) - smarter_csv 1.16.2 -> 1.18.0 (#436) - overcommit 0.68.0 -> 0.69.0 (#409) Note: grape-swagger 2.1.4 emits a desc() deprecation under grape 3; upstream lag, docs still generate and API specs pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Deps: bump JS packages - esbuild 0.25.0 -> 0.28.1 (#452) - swagger-ui-dist 5.27.1 -> 5.32.8 (#439) - chart.js 4.4.9 -> 4.5.1 (#430) - postcss 8.5.1 -> 8.5.15 (#442) - autoprefixer 10.4.20 -> 10.5.1 (#429) JS and CSS builds verified. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Jenn Thom <jenn.thom@gmail.com> Co-authored-by: Rob DiCiuccio <rdiciuccio@codeforamerica.org> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
![aikido-pr-checks[bot]](https://avatars.githubusercontent.com/in/898896?s=60&v=4){kind=small}
| "private": true, | ||
| "devDependencies": { | ||
| "esbuild": "^0.25.0" | ||
| "esbuild": "^0.28.1" |
There was a problem hiding this comment.
esbuild is specified as "esbuild": "^0.28.1" (caret range). Pin exact versions instead of semver ranges to prevent silent upgrades.
Details
✨ AI Reasoning
The change updates dependency entries in package.json to newer versions but keeps caret (^) semver ranges, which allows automatic minor/patch upgrades. The intent of the policy is to require exact version pins. This harms reproducible builds and was introduced/worsened by this PR because the updated lines now continue to use non-exact pins. Flag at the lines where the new caret-pinned versions were added.
🔧 How do I fix it?
Include lockfiles in your repo and CI. Pin exact versions or SHAs in manifests. Enable checksum verification. Set ignore-scripts in npm or equivalent. Enforce a 72hr minimum package age policy to avoid newly published malicious packages.
Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info
| "daisyui": "^4.12.23", | ||
| "postcss": "^8.5.1", | ||
| "swagger-ui-dist": "^5.27.1", | ||
| "postcss": "^8.5.15", |
There was a problem hiding this comment.
postcss is specified as "postcss": "^8.5.15" (caret range). Pin exact versions and add checksum verification where supported.
Details
✨ AI Reasoning
postcss was bumped but remains a caret-range dependency. The project-level dependency manifest now includes non-exact pins, which conflicts with the rule requiring exact versions and checksums.
🔧 How do I fix it?
Include lockfiles in your repo and CI. Pin exact versions or SHAs in manifests. Enable checksum verification. Set ignore-scripts in npm or equivalent. Enforce a 72hr minimum package age policy to avoid newly published malicious packages.
Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info
* Require LOCALSTACK_AUTH_TOKEN for local LocalStack LocalStack's unified image (2026.03.0+) requires an auth token. Pass it through from the environment and fail fast with actionable guidance when it's unset, instead of the cryptic exit-code-55 license error. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Dependabot: monitor Python components (pip) Add a pip ecosystem covering all six python_components manifests so their dependencies get update PRs and security alerts, closing the gap where only bundler/npm/actions were watched. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * SES: pin module to v0.25.2 to stop key rotation terraform/modules/ses/main.tf referenced cloudposse/terraform-aws-ses with no version ref (floating HEAD). An older module version created an auto-expiring SMTP access key (awsutils_expiring_iam_access_key, 30-day max_age); current upstream creates a plain non-rotating aws_iam_access_key. The floating ref made plans nondeterministic and triggered an expiring->regular key migration in CI that needs iam:DeleteAccessKey/ CreateAccessKey -- permissions the GitHub Actions role intentionally lacks. Pin to v0.25.2, which uses iam-system-user 1.2.1: a stable, non-rotating access key (iam_create_access_key defaults to true). No max_age knob is needed -- that variable does not exist in v0.25.2. Note: the expiring->regular switch is a one-time replacement requiring privileged IAM creds (not the CI role), and rotates the SMTP credentials, so SMTP_USER/SMTP_PASSWORD in Secrets Manager must be updated from the new key or outbound email breaks. After that single apply, CI deploys go green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
| open-pull-requests-limit: 10 | ||
| cooldown: | ||
| default-days: 7 | ||
| - package-ecosystem: pip |
There was a problem hiding this comment.
Added pip package-ecosystem monitoring without enforcing lockfiles or hashed requirements; ensure each python_components directory includes pinned, hash-verified requirements (e.g., requirements.txt with hashes or a pipfile.lock) so Dependabot updates use checksum-verified lockfiles.
Details
✨ AI Reasoning
Dependabot configuration for the pip ecosystem was added. The intent is to monitor Python package updates. The added block (package-ecosystem: pip and directories list) does not include any reference to pinned hashes, constraints files with hashes, or an explicit requirement that lockfiles or hashed requirements are used in those directories. This can permit Dependabot PRs that update requirements without ensuring checksum verification or pinned versions are present in the repo/build process, violating the rule that package lockfiles and checksum verification must be enforced. The terraform source pin change improved pinning and does not violate the rule. The docker-compose addition is unrelated to dependency manifests.
🔧 How do I fix it?
Include lockfiles in your repo and CI. Pin exact versions or SHAs in manifests. Enable checksum verification. Set ignore-scripts in npm or equivalent. Enforce a 72hr minimum package age policy to avoid newly published malicious packages.
Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info
1 participant
Uh oh!
There was an error while loading. Please reload this page.