Skip to content

Audit Snyk check/fix 1.22 - #4079

Open
geo-ghci-int[bot] wants to merge 1 commit into
1.22from
ghci/audit/snyk/1.22
Open

Audit Snyk check/fix 1.22#4079
geo-ghci-int[bot] wants to merge 1 commit into
1.22from
ghci/audit/snyk/1.22

Conversation

@geo-ghci-int

@geo-ghci-int geo-ghci-int Bot commented Nov 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Fixes applied (pins added to requirements files)

The rescan still reports these vulnerabilities because Snyk builds the pip dependency tree
from the packages installed in the audit environment, which is not reinstalled after the fix.

snyk fix output

⠋ Running snyk test for /root/.cache/ghci/git/worktrees/camptocamp/tilecloud-chain/1.22/tilecloud-chain
► Running snyk test for /root/.cache/ghci/git/worktrees/camptocamp/tilecloud-chain/1.22/tilecloud-chain

  • Looking for supported Python items
    ✔ Looking for supported Python items
  • Looking for supported Python items
    ✔ Looking for supported Python items
    ⠋ Processing 1 pyproject.toml items⠋ Processing 2 requirements.txt items✔ Processed 2 requirements.txt items
  • Checking poetry version
    ⚠️ Could not detect poetry version, proceeding anyway. Some operations may fail.
  • Fixing pyproject.toml 1/1
    ✔ Processed 1 pyproject.toml items
    ERROR Unspecified Error (SNYK-CLI-0000)
    ✖ No successful fixes
    Unresolved items:
    pyproject.toml
    x Failed to upgrade pillow from 12.3.0 to 13.0.0
    Reason: No fixes could be applied.
    Tip: Try running poetry add pillow==13.0.0
    Summary:
    1 items were not fixed
    1 items were not vulnerable
    39 issues: 6 Critical | 23 High | 10 Medium
    36 issues are fixable
    Tip: Re-run in debug mode to see more information: DEBUG=*snyk* .
    If the issue persists contact support@snyk.io
    Docs: https://docs.snyk.io/scan-with-snyk/error-catalog#snyk-cli-0000
    Tip: Try snyk doctor: snyk <command> -d 2>&1 | snyk doctor --stdin
    ID: urn:snyk:interaction:f9456136-b9a2-4c08-8b69-979428ebb132

Logs | Output

@geo-ghci-int
geo-ghci-int Bot enabled auto-merge November 5, 2026 18:55
@sbrunner
sbrunner disabled auto-merge November 6, 2026 18:14
@geo-ghci-int
geo-ghci-int Bot force-pushed the ghci/audit/snyk/1.22 branch from c6837e7 to 395935f Compare November 6, 2026 19:47
@sbrunner
Ignore CVE on poetry and its transitive dependencies not compatible w…
cb0ce8c 
…ith used Poetry version

The Snyk fix pinned poetry>=2.3.4 in ci/requirements.txt and bumped
poetry to 2.3.4 in requirements.txt, but poetry-plugin-tweak-dependencies-version
1.5.7 requires poetry<2.1.0, and pip failed with ResolutionImpossible.

The poetry upgrade is blocked by the plugin incompatibility, and while
poetry stays at 1.8.5, the following transitive dependencies cannot
be upgraded to their fixed versions:
- dulwich: poetry requires dulwich<0.23.0, the fixes need dulwich>=1.1.0
  (SNYK-PYTHON-DULWICH-17054926/17054927/17266106/18016337/20416729/20416732/22220108)
- virtualenv: poetry requires virtualenv<21.0.0, the fixes need
  virtualenv>=21.7.11
  (SNYK-PYTHON-VIRTUALENV-20335491/20335492/20335493/20335500/21282339/21282342/21282424/21282484/21282509)
- filelock: virtualenv requires filelock<4.0.0, the fixes need filelock>=4.0.9
  (SNYK-PYTHON-FILELOCK-21280750/21280753/21280754/21280755/21280756/21280759/21280760/21280761/21689161/21689162/21802489/21802490/21802520)
- poetry itself: Plugin not compatible with new Poetry version
  (SNYK-PYTHON-POETRY-15873752/16122096)

Drop the Snyk pins from ci/requirements.txt and requirements.txt and
ignore those advisories in .snyk and ci/.snyk, following the same policy
already applied on the 1.21 branch.

Failing CI: https://github.com/camptocamp/tilecloud-chain/actions/runs/42282692329/job/128115474462
Audit logs: https://geoservices-int.camptocamp.com/github/logs/3302538
@sbrunner
sbrunner force-pushed the ghci/audit/snyk/1.22 branch from 395935f to cb0ce8c Compare November 6, 2026 22:17
@geo-ghci-int
geo-ghci-int Bot force-pushed the ghci/audit/snyk/1.22 branch from cb0ce8c to af30563 Compare November 7, 2026 20:32
@sbrunner
sbrunner force-pushed the ghci/audit/snyk/1.22 branch from af30563 to cb0ce8c Compare November 8, 2026 14:05
@sbrunner sbrunner mentioned this pull request Nov 8, 2026
Open
@geo-ghci-int
geo-ghci-int Bot force-pushed the ghci/audit/snyk/1.22 branch from cb0ce8c to 0c3d299 Compare November 8, 2026 20:19
@sbrunner
sbrunner force-pushed the ghci/audit/snyk/1.22 branch from 0c3d299 to cb0ce8c Compare November 8, 2026 20:40
@sbrunner

sbrunner commented Nov 8, 2026

Copy link
Copy Markdown
Member

CI fails deterministically: the Snyk pin poetry>=2.3.4 conflicts with poetry-plugin-tweak-dependencies-version==1.5.7 (requires poetry<2.1.0), still needed by [build-system] on 1.22 (pip ResolutionImpossible, e.g. https://github.com/camptocamp/tilecloud-chain/actions/runs/42519517418/job/128849728351).

The branch was again reset to the fix commit cb0ce8cf (drop the unresolvable pins + add .snyk/ci/.snyk ignores), same policy as the already merged 1.21 ones (e.g. #4023).

Note: the audit runs scan the 1.22 branch, so every audit run re-applies the pins and overwrites this branch. To end the loop, please review/merge #4083 (same content, targeting 1.22); after it is merged the audit will no longer pin these advisories and this PR becomes moot.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@sbrunner