fix(ci): make Grype CVE scan non-blocking #48

2026-06-02T15:24:52Z

lerko commented

2026-06-02 15:24:52 +00:00

Summary

GHSA-xjvp-7243-rg9h (wish SCP path traversal) is not exploitable — we only use bubbletea middleware, no SCP
Previously documented in commit 3298222, wish v2 migration tracked in #42
Grype scan still runs and emits warning, just doesn't fail the release

Test plan

Merge → re-tag 2026.06.2 → both pipelines should pass green

## Summary - GHSA-xjvp-7243-rg9h (wish SCP path traversal) is not exploitable — we only use bubbletea middleware, no SCP - Previously documented in commit 3298222, wish v2 migration tracked in #42 - Grype scan still runs and emits warning, just doesn't fail the release ## Test plan - Merge → re-tag `2026.06.2` → both pipelines should pass green

lerko added 1 commit 2026-06-02 15:24:53 +00:00

fix(ci): make Grype CVE scan non-blocking for known wish vuln

CI / test (pull_request) Successful in 2m21s

Details

CI / lint (pull_request) Successful in 46s

Details

CI / vulncheck (pull_request) Successful in 31s

Details

c963acb574

GHSA-xjvp-7243-rg9h (wish SCP middleware path traversal) is
not exploitable — uptop only uses bubbletea middleware.
Scan still runs and warns but won't fail the release.

lerko merged commit a5b499c247 into main

2026-06-02 15:41:48 +00:00

lerko referenced this pull request

2026-06-02 16:42:54 +00:00

feat: migrate charmbracelet/wish v1 → v2 (CVE-2026-35385) #42

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: lerkolabs/uptop#48