Fix security vuln by soumeh01 · Pull Request #621 · Open-CMSIS-Pack/cbuild

soumeh01 · 2026-05-19T11:22:17Z

Fixes

Checklist

🤖 This change is covered by unit tests (if applicable).
🤹 Manual testing has been performed (if necessary).
🛡️ Security impacts have been considered (if relevant).
📖 Documentation updates are complete (if required).
🧠 Third-party dependencies and TPIP updated (if required).

github-actions · 2026-05-19T11:24:56Z

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
⚠️ 11 package(s) with unknown licenses.

See the Details below.

Snapshot Warnings

⚠️: The number of snapshots compared for the base SHA (0) and the head SHA (1) do not match. You may see unexpected additions in the diff.

Re-running this action after a short time may resolve the issue. See the documentation for more information and troubleshooting advice.

License Issues

go.mod

Package	Version	License	Issue Type
github.com/creack/pty	v1.1.24	Null	Unknown License
github.com/davecgh/go-spew	v1.1.1	Null	Unknown License
github.com/hashicorp/go-version	v1.9.0	Null	Unknown License
github.com/otiai10/copy	v1.14.1	Null	Unknown License
github.com/pmezard/go-difflib	v1.0.0	Null	Unknown License
github.com/sirupsen/logrus	v1.9.4	Null	Unknown License
github.com/spf13/cobra	v1.10.2	Null	Unknown License
github.com/spf13/pflag	v1.0.10	Null	Unknown License
github.com/stretchr/testify	v1.11.1	Null	Unknown License
golang.org/x/term	v0.43.0	Null	Unknown License
gopkg.in/yaml.v3	v3.0.1	Null	Unknown License

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

gomod/github.com/aymanbagabas/go-pty

v0.2.3

🟢 3.8

Details

Check	Score	Reason
Code-Review	🟢 3	Found 1/3 approved changesets -- score normalized to 3
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 7	9 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 7
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Security-Policy	⚠️ 0	security policy file not detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

gomod/github.com/creack/pty

v1.1.24

Unknown

gomod/github.com/davecgh/go-spew

v1.1.1

Unknown

gomod/github.com/hashicorp/go-version

v1.9.0

Unknown

gomod/github.com/otiai10/copy

v1.14.1

Unknown

gomod/github.com/pmezard/go-difflib

v1.0.0

Unknown

gomod/github.com/sirupsen/logrus

v1.9.4

Unknown

gomod/github.com/spf13/cobra

v1.10.2

Unknown

gomod/github.com/spf13/pflag

v1.0.10

Unknown

gomod/github.com/stretchr/testify

v1.11.1

Unknown

gomod/github.com/u-root/u-root

v0.16.0

🟢 7.4

Details

Check	Score	Reason
Security-Policy	🟢 4	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 2	badge detected: InProgress
Fuzzing	🟢 10	project is fuzzed
Binary-Artifacts	🟢 9	binaries present in source code
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Packaging	🟢 10	packaging workflow detected
SAST	🟢 10	SAST tool is run on all commits
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0

gomod/golang.org/x/crypto

v0.51.0

Unknown

gomod/golang.org/x/sync

v0.18.0

Unknown

gomod/golang.org/x/sys

v0.44.0

Unknown

gomod/golang.org/x/term

v0.43.0

Unknown

gomod/gopkg.in/yaml.v3

v3.0.1

Unknown

Scanned Files

.github/workflows/global.yaml
go.mod

qltysh · 2026-05-19T11:29:07Z

Coverage Impact

This PR will not change total coverage.

🚦 See full report on Qlty Cloud »

🛟 Help

Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.
Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.
File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)
- Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.

github-actions · 2026-05-19T11:29:35Z

Test Results

6 files ±0 60 suites ±0 11s ⏱️ -1s
307 tests ±0 307 ✅ ±0 0 💤 ±0 0 ❌ ±0
1 842 runs ±0 1 842 ✅ ±0 0 💤 ±0 0 ❌ ±0

Results for commit 0b5f195. ± Comparison against base commit fa71714.

Copilot

Pull request overview

Updates GitHub Actions workflows to address security/code-scanning findings by tightening how third-party tooling is installed during CI checks.

Changes:

Switches the TPIP workflow to install go-licenses from the v2 module path.
Pins pre-commit and comment-parser to exact versions in the global workflow.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
.github/workflows/tpip-check.yml	Updates the `go-licenses` installation source used for TPIP reporting/checks.
.github/workflows/global.yaml	Pins Python tooling versions used by the copyright notice check.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

soumeh01 force-pushed the fix-vuln branch from a22a0a8 to 0b5f195 Compare May 19, 2026 11:24

soumeh01 force-pushed the fix-vuln branch from 0b5f195 to 2bef3e9 Compare May 19, 2026 11:36

soumeh01 marked this pull request as ready for review May 19, 2026 11:39

Copilot AI review requested due to automatic review settings May 19, 2026 11:39

Copilot started reviewing on behalf of soumeh01 May 19, 2026 11:40 View session

Copilot AI reviewed May 19, 2026

View reviewed changes

Comment thread .github/workflows/tpip-check.yml Outdated

Comment thread .github/workflows/tpip-check.yml Outdated

Comment thread .github/workflows/global.yml Outdated

soumeh01 force-pushed the fix-vuln branch from 2bef3e9 to 615eb9e Compare May 19, 2026 12:01

Copilot AI review requested due to automatic review settings May 19, 2026 12:03

soumeh01 force-pushed the fix-vuln branch from 615eb9e to 8f3ca5c Compare May 19, 2026 12:03

Copilot started reviewing on behalf of soumeh01 May 19, 2026 12:03 View session

Copilot AI reviewed May 19, 2026

View reviewed changes

Comment thread .github/workflows/tpip-check.yml Outdated

soumeh01 force-pushed the fix-vuln branch from 8f3ca5c to 479c3a4 Compare May 19, 2026 12:11

Fix security vuln

9ec8cc4

soumeh01 force-pushed the fix-vuln branch from 479c3a4 to 9ec8cc4 Compare May 19, 2026 12:12

Copilot AI review requested due to automatic review settings May 19, 2026 12:12

Copilot started reviewing on behalf of soumeh01 May 19, 2026 12:13 View session

Copilot AI reviewed May 19, 2026

View reviewed changes

Comment thread .github/workflows/tpip-check.yml

soumeh01 requested a review from brondani May 19, 2026 14:15

Merge branch 'main' into fix-vuln

9b70000

brondani approved these changes May 19, 2026

View reviewed changes

soumeh01 merged commit 705e1db into main May 19, 2026
5 checks passed

soumeh01 deleted the fix-vuln branch May 19, 2026 14:21

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fix security vuln#621

Fix security vuln#621
soumeh01 merged 2 commits into
mainfrom
fix-vuln

soumeh01 commented May 19, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 19, 2026 •

edited

Loading

Uh oh!

qltysh Bot commented May 19, 2026

Uh oh!

github-actions Bot commented May 19, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

soumeh01 commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Fixes

Checklist

Uh oh!

github-actions Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

Snapshot Warnings

License Issues

go.mod

OpenSSF Scorecard

Scanned Files

Uh oh!

qltysh Bot commented May 19, 2026

Uh oh!

github-actions Bot commented May 19, 2026

Test Results

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

soumeh01 commented May 19, 2026 •

edited

Loading

github-actions Bot commented May 19, 2026 •

edited

Loading