fix: resolve 47 code scanning alerts by imran-siddique · Pull Request #102 · microsoft/agent-governance-toolkit

imran-siddique · 2026-03-08T18:21:32Z

Summary

Addresses all actionable code scanning alerts from CodeQL and OpenSSF Scorecard.

CodeQL Fixes (12 alerts)

py/incomplete-url-substring-sanitization (2 alerts): Use urlparse for proper domain validation instead of substring check
py/clear-text-logging-sensitive-data (10 alerts): Rewrote _redact() in 4 example files to use SHA-256 hash-based identifiers, breaking the taint chain

OpenSSF Scorecard Fixes (35+ alerts)

CI workflows (8 alerts): Pinned pip packages to version ranges in ci.yml, publish.yml, policy-validation.yml
Dockerfiles (20+ alerts): Added upper-bound version constraints to all requirements.txt files consumed by Dockerfiles
Shell scripts (4 alerts): Pinned package versions in quickstart.sh, build_and_publish.sh, gh-agent-os, run-demo.sh

Not Fixable via Code (6 alerts)

BranchProtectionID, CIIBestPracticesID, CodeReviewID, FuzzingID, MaintainedID, SASTID - repo-level settings requiring admin configuration

Testing

All 28 integrity/verify tests pass
Full suite: 2,762 passed, 43 skipped, 1 pre-existing failure (unrelated test_layer4_intelligence.py)

32 files changed across packages.

…ing, dependency pinning - Fix py/incomplete-url-substring-sanitization (2 alerts): Use urlparse for proper domain validation instead of substring check in test assertions - Fix py/clear-text-logging-sensitive-data (10 alerts): Replace _redact() with hash-based redaction using SHA-256 digests to break taint chain while preserving correlation capability across 4 example files - Fix PinnedDependenciesID in CI workflows (8 alerts): Pin ruff, pytest, pytest-asyncio, safety, build, pyyaml to version ranges in ci.yml, publish.yml, and policy-validation.yml - Fix PinnedDependenciesID in Dockerfiles (20+ alerts): Add upper-bound version constraints to all requirements.txt files used by Dockerfiles - Fix PinnedDependenciesID in shell scripts (4 alerts): Pin package versions in quickstart.sh, build_and_publish.sh, gh-agent-os, run-demo.sh 32 files changed, 47 alerts addressed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-03-08T18:21:48Z

Dependency Review

The following issues were found:

❌ 2 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
⚠️ 43 package(s) with unknown licenses.

See the Details below.

Vulnerabilities

packages/agent-os/modules/caas/requirements.txt

Name	Version	Vulnerability	Severity
pypdf	>= 4.0.0,< 5.0.0	PyPDF's Manipulated FlateDecode streams can exhaust RAM	moderate
		pypdf possibly loops infinitely when reading DCT inline images without EOF marker	moderate
		pypdf can exhaust RAM via manipulated LZWDecode streams	moderate
		pypdf's LZWDecode streams be manipulated to exhaust RAM	moderate
		pypdf has possible Infinite Loop when processing outlines/bookmarks	moderate
		pypdf has a possible infinite loop when processing TreeObject	moderate
		pypdf has possible long runtimes/large memory usage for large /ToUnicode streams	moderate
		pypdf possibly has long runtimes for malformed FlateDecode streams	moderate
		pypdf: Manipulated FlateDecode XFA streams can exhaust RAM	moderate
		pypdf: Manipulated RunLengthDecode streams can exhaust RAM	moderate
		pypdf vulnerable to inefficient decoding of ASCIIHexDecode streams	moderate

packages/agent-os/services/cloud-board/requirements.txt

Name	Version	Vulnerability	Severity
pypdf	>= 4.0.0,< 5.0.0	PyPDF's Manipulated FlateDecode streams can exhaust RAM	moderate
		pypdf possibly loops infinitely when reading DCT inline images without EOF marker	moderate
		pypdf can exhaust RAM via manipulated LZWDecode streams	moderate
		pypdf's LZWDecode streams be manipulated to exhaust RAM	moderate
		pypdf has possible Infinite Loop when processing outlines/bookmarks	moderate
		pypdf has a possible infinite loop when processing TreeObject	moderate
		pypdf has possible long runtimes/large memory usage for large /ToUnicode streams	moderate
		pypdf possibly has long runtimes for malformed FlateDecode streams	moderate
		pypdf: Manipulated FlateDecode XFA streams can exhaust RAM	moderate
		pypdf: Manipulated RunLengthDecode streams can exhaust RAM	moderate
		pypdf vulnerable to inefficient decoding of ASCIIHexDecode streams	moderate
cryptography	>= 42.0.0,< 45.0.0	cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves	high

Only included vulnerabilities with severity moderate or higher.

License Issues

packages/agent-os/modules/caas/requirements.txt

Package	Version	License	Issue Type
pypdf	>= 4.0.0,< 5.0.0	Null	Unknown License
aiofiles	>= 23.2.1,< 24.0.0	Null	Unknown License
beautifulsoup4	>= 4.12.2,< 5.0.0	Null	Unknown License
fastapi	>= 0.115.0,< 1.0.0	Null	Unknown License
lxml	>= 4.9.3,< 6.0.0	Null	Unknown License
numpy	>= 1.26.2,< 2.0.0	Null	Unknown License
pydantic	>= 2.5.0,< 3.0.0	Null	Unknown License
python-multipart	>= 0.0.22,< 1.0.0	Null	Unknown License
scikit-learn	>= 1.6.1,< 2.0.0	Null	Unknown License
tiktoken	>= 0.5.1,< 1.0.0	Null	Unknown License
uvicorn	>= 0.27.0,< 1.0.0	Null	Unknown License

packages/agent-os/modules/cmvk/requirements.txt

Package	Version	License	Issue Type
numpy	>= 1.24.0,< 2.0.0	Null	Unknown License
scipy	>= 1.11.0,< 2.0.0	Null	Unknown License

packages/agent-os/modules/iatp/requirements.txt

Package	Version	License	Issue Type
agent-primitives	>= 0.1.0,< 1.0.0	Null	Unknown License
fastapi	>= 0.109.1,< 1.0.0	Null	Unknown License

packages/agent-os/modules/scak/requirements.txt

Package	Version	License	Issue Type
langchain-core	>= 0.1.0,< 1.0.0	Null	Unknown License
agent-primitives	>= 0.1.0,< 1.0.0	Null	Unknown License
anthropic	>= 0.7.0,< 1.0.0	Null	Unknown License
jupyter	>= 1.0.0,< 2.0.0	Null	Unknown License
langchain	>= 0.1.0,< 1.0.0	Null	Unknown License
openai	>= 1.0.0,< 2.0.0	Null	Unknown License
pydantic	>= 2.0.0,< 3.0.0	Null	Unknown License
pytest	>= 7.4.0,< 9.0.0	Null	Unknown License
pytest-asyncio	>= 0.21.0,< 1.0.0	Null	Unknown License
pyyaml	>= 6.0,< 7.0.0	Null	Unknown License
streamlit	>= 1.37.0,< 2.0.0	Null	Unknown License

packages/agent-os/services/cloud-board/requirements.txt

Package	Version	License	Issue Type
cryptography	>= 42.0.0,< 45.0.0	Null	Unknown License
aiohttp	>= 3.13.3,< 4.0.0	Null	Unknown License
black	>= 24.3.0,< 25.0.0	Null	Unknown License
fastapi	>= 0.109.0,< 1.0.0	Null	Unknown License
httpx	>= 0.26.0,< 1.0.0	Null	Unknown License
mypy	>= 1.8.0,< 2.0.0	Null	Unknown License
opentelemetry-api	>= 1.22.0,< 2.0.0	Null	Unknown License
opentelemetry-instrumentation-fastapi	>= 0.43b0,< 1.0	Null	Unknown License
opentelemetry-sdk	>= 1.22.0,< 2.0.0	Null	Unknown License
pydantic	>= 2.5.0,< 3.0.0	Null	Unknown License
pynacl	>= 1.5.0,< 2.0.0	Null	Unknown License
pytest	>= 7.4.0,< 9.0.0	Null	Unknown License
pytest-asyncio	>= 0.23.0,< 1.0.0	Null	Unknown License
pytest-cov	>= 4.1.0,< 6.0.0	Null	Unknown License
ruff	>= 0.1.0,< 1.0.0	Null	Unknown License
structlog	>= 24.1.0,< 25.0.0	Null	Unknown License
uvicorn	>= 0.27.0,< 1.0.0	Null	Unknown License

Allowed Licenses: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, PSF-2.0, Python-2.0, 0BSD, Unlicense, CC0-1.0, CC-BY-4.0, Zlib, BSL-1.0, MPL-2.0

OpenSSF Scorecard

Scorecard details

Package	Version	Score	Details
pip/pypdf	>= 4.0.0,< 5.0.0	Unknown	Unknown
pip/aiofiles	>= 23.2.1,< 24.0.0	Unknown	Unknown
pip/beautifulsoup4	>= 4.12.2,< 5.0.0	Unknown	Unknown
pip/fastapi	>= 0.115.0,< 1.0.0	Unknown	Unknown
pip/lxml	>= 4.9.3,< 6.0.0	Unknown	Unknown
pip/numpy	>= 1.26.2,< 2.0.0	Unknown	Unknown
pip/pydantic	>= 2.5.0,< 3.0.0	Unknown	Unknown
pip/python-multipart	>= 0.0.22,< 1.0.0	Unknown	Unknown
pip/scikit-learn	>= 1.6.1,< 2.0.0	Unknown	Unknown
pip/tiktoken	>= 0.5.1,< 1.0.0	Unknown	Unknown
pip/uvicorn	>= 0.27.0,< 1.0.0	Unknown	Unknown
pip/numpy	>= 1.24.0,< 2.0.0	Unknown	Unknown
pip/scipy	>= 1.11.0,< 2.0.0	Unknown	Unknown
pip/agent-primitives	>= 0.1.0,< 1.0.0	Unknown	Unknown
pip/fastapi	>= 0.109.1,< 1.0.0	Unknown	Unknown
pip/langchain-core	>= 0.1.0,< 1.0.0	Unknown	Unknown
pip/agent-primitives	>= 0.1.0,< 1.0.0	Unknown	Unknown
pip/anthropic	>= 0.7.0,< 1.0.0	Unknown	Unknown
pip/jupyter	>= 1.0.0,< 2.0.0	Unknown	Unknown
pip/langchain	>= 0.1.0,< 1.0.0	Unknown	Unknown
pip/openai	>= 1.0.0,< 2.0.0	Unknown	Unknown
pip/pydantic	>= 2.0.0,< 3.0.0	Unknown	Unknown
pip/pytest	>= 7.4.0,< 9.0.0	Unknown	Unknown
pip/pytest-asyncio	>= 0.21.0,< 1.0.0	Unknown	Unknown
pip/pyyaml	>= 6.0,< 7.0.0	Unknown	Unknown
pip/streamlit	>= 1.37.0,< 2.0.0	Unknown	Unknown
pip/cryptography	>= 42.0.0,< 45.0.0	Unknown	Unknown
pip/aiohttp	>= 3.13.3,< 4.0.0	Unknown	Unknown
pip/black	>= 24.3.0,< 25.0.0	Unknown	Unknown
pip/fastapi	>= 0.109.0,< 1.0.0	Unknown	Unknown
pip/httpx	>= 0.26.0,< 1.0.0	Unknown	Unknown
pip/mypy	>= 1.8.0,< 2.0.0	Unknown	Unknown
pip/opentelemetry-api	>= 1.22.0,< 2.0.0	Unknown	Unknown
pip/opentelemetry-instrumentation-fastapi	>= 0.43b0,< 1.0	Unknown	Unknown
pip/opentelemetry-sdk	>= 1.22.0,< 2.0.0	Unknown	Unknown
pip/pydantic	>= 2.5.0,< 3.0.0	Unknown	Unknown
pip/pynacl	>= 1.5.0,< 2.0.0	Unknown	Unknown
pip/pytest	>= 7.4.0,< 9.0.0	Unknown	Unknown
pip/pytest-asyncio	>= 0.23.0,< 1.0.0	Unknown	Unknown
pip/pytest-cov	>= 4.1.0,< 6.0.0	Unknown	Unknown
pip/ruff	>= 0.1.0,< 1.0.0	Unknown	Unknown
pip/structlog	>= 24.1.0,< 25.0.0	Unknown	Unknown
pip/uvicorn	>= 0.27.0,< 1.0.0	Unknown	Unknown

Scanned Files

packages/agent-os/modules/caas/requirements.txt
packages/agent-os/modules/cmvk/requirements.txt
packages/agent-os/modules/iatp/requirements.txt
packages/agent-os/modules/scak/requirements.txt
packages/agent-os/services/cloud-board/requirements.txt

imran-siddique merged commit fb230bb into main Mar 8, 2026
22 of 25 checks passed

imran-siddique deleted the fix/code-scanning-v1.1 branch March 8, 2026 18:21

github-actions bot added dependencies Pull requests that update a dependency file tests agent-mesh agent-mesh package agent-hypervisor agent-hypervisor package agent-sre agent-sre package ci/cd CI/CD and workflows labels Mar 8, 2026

github-actions bot added the size/M Medium PR (< 200 lines) label Mar 8, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: resolve 47 code scanning alerts#102

fix: resolve 47 code scanning alerts#102
imran-siddique merged 1 commit intomainfrom
fix/code-scanning-v1.1

imran-siddique commented Mar 8, 2026

Uh oh!

Uh oh!

github-actions bot commented Mar 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

imran-siddique commented Mar 8, 2026

Summary

CodeQL Fixes (12 alerts)

OpenSSF Scorecard Fixes (35+ alerts)

Not Fixable via Code (6 alerts)

Testing

Uh oh!

Uh oh!

github-actions bot commented Mar 8, 2026

Dependency Review

Vulnerabilities

packages/agent-os/modules/caas/requirements.txt

packages/agent-os/services/cloud-board/requirements.txt

License Issues

packages/agent-os/modules/caas/requirements.txt

packages/agent-os/modules/cmvk/requirements.txt

packages/agent-os/modules/iatp/requirements.txt

packages/agent-os/modules/scak/requirements.txt

packages/agent-os/services/cloud-board/requirements.txt

OpenSSF Scorecard

Scanned Files

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant