Skip to content

Conversation

@philips-software-forest-releaser
Copy link
Contributor

Automated changes by create-pull-request GitHub action

@philips-software-forest-releaser philips-software-forest-releaser bot requested a review from a team as a code owner January 8, 2026 14:15
@philips-software-forest-releaser philips-software-forest-releaser bot added apt dependencies Pull requests that update a dependency file labels Jan 8, 2026
@sonarqubecloud
Copy link

sonarqubecloud bot commented Jan 8, 2026

@github-actions
Copy link
Contributor

github-actions bot commented Jan 8, 2026

Test Results

0 files   -  5  0 suites   - 5   0s ⏱️ - 3m 32s
0 tests  - 32  0 ✅  - 32  0 💤 ±0  0 ❌ ±0 
0 runs   - 67  0 ✅  - 67  0 💤 ±0  0 ❌ ±0 

Results for commit 4d6d450. ± Comparison against base commit 55e3a3e.

@github-actions
Copy link
Contributor

github-actions bot commented Jan 8, 2026

MegaLinter analysis: Error

Descriptor Linter Files Fixed Errors Warnings Elapsed time
✅ ACTION actionlint 20 0 0 0.54s
✅ DOCKERFILE hadolint 2 0 0 0.79s
✅ GHERKIN gherkin-lint 6 0 0 2.47s
✅ JSON npm-package-json-lint yes no no 0.47s
✅ JSON prettier 19 4 0 0 0.58s
✅ JSON v8r 19 0 0 7.67s
✅ MARKDOWN markdownlint 11 0 0 0 0.87s
✅ MARKDOWN markdown-table-formatter 11 0 0 0 0.26s
✅ REPOSITORY checkov yes no no 18.3s
✅ REPOSITORY gitleaks yes no no 0.53s
✅ REPOSITORY git_diff yes no no 0.01s
❌ REPOSITORY grype yes 1 no 29.76s
✅ REPOSITORY secretlint yes no no 1.02s
✅ REPOSITORY syft yes no no 2.04s
❌ REPOSITORY trivy yes 1 no 5.46s
✅ REPOSITORY trivy-sbom yes no no 0.25s
✅ REPOSITORY trufflehog yes no no 2.22s
✅ SPELL lychee 77 0 0 21.46s
✅ YAML prettier 28 0 0 0 1.03s
✅ YAML v8r 28 0 0 8.61s
✅ YAML yamllint 28 0 0 0.78s

Detailed Issues

❌ REPOSITORY / grype - 1 error
error: A high vulnerability in python package: urllib3, version 2.6.0 was found at: /.devcontainer/cpp/requirements.txt

error: 1 errors emitted
❌ REPOSITORY / trivy - 1 error
error: Package: urllib3
Installed Version: 2.6.0
Vulnerability CVE-2026-21441
Severity: HIGH
Fixed Version: 2.6.3
Link: [CVE-2026-21441](https://avd.aquasec.com/nvd/cve-2026-21441)
    ┌─ .devcontainer/cpp/requirements.txt:402:1
    │
402 │ urllib3==2.6.0 \
    │ ^
    │
    = urllib3 is an HTTP client library for Python. urllib3's streaming API  ...
    = urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable redirects by setting `redirect=False` for requests to untrusted source.

error: 1 errors emitted

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

  • Documentation: Custom Flavors
  • Command: npx mega-linter-runner@9.2.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,DOCKERFILE_HADOLINT,GHERKIN_GHERKIN_LINT,JSON_V8R,JSON_PRETTIER,JSON_NPM_PACKAGE_JSON_LINT,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_GRYPE,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_LYCHEE,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

MegaLinter is graciously provided by OX Security

@rjaegers
Copy link
Member

rjaegers commented Jan 8, 2026

Combined with #1075

@rjaegers rjaegers closed this Jan 8, 2026
@github-actions
Copy link
Contributor

github-actions bot commented Jan 8, 2026

Pull Request Report (#1070)

Static measures

Description Value
Number of added lines 1
Number of deleted lines 1
Number of changed files 1
Number of commits 1
Number of reviews 0
Number of comments (w/o review comments) 4
Number of reviews that contains a comment to resolve 0
Number of reviews that requested a change from the author 0
Number of reviews that approved the Pull Request 0
Get the total number of participants of a Pull Request 4

Time related measures

Description Value
PR lead time (from creation to close of PR) 23.2 Min
Time that was spend on the branch before the PR was created 3 Sec
Time that was spend on the branch before the PR was merged 0 Sec
Time to merge after last review 0 Sec

Status check related measures

Description Value
Total runtime for last status check run (Workflow for PR) 10.9 Min
Total time spend in last status check run on PR 3 Min

@rjaegers rjaegers deleted the feature/amp-devcontainer-rust/update-apt-packages branch January 8, 2026 14:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

apt dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants