Cover Python 3.10–3.12 in temporary Grype exceptions - #14
Merged
Merged
Conversation
Add exact CVE-2026-82049 rules for Python 3.12.14, 3.11.16, and 3.10.21. All 18 remaining failed builds report this finding; Python 3.13 already passes. Track removal of all four version-specific rules in issue #12.
csandanov
marked this pull request as ready for review
September 20, 2026 05:10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The previous exception covered only Python 3.13.15. All 18 Python 3.10, 3.11, and 3.12 build variants still fail Grype on the same CVE-2026-82049 finding.
Add exact rules for the
pythonbinary package at versions3.12.14,3.11.16, and3.10.21. This temporarily accepts the tarfile vulnerability while awaiting fixed upstream images. Removal is tracked in #12. No other vulnerabilities or package versions are excluded.Validation: parsed the YAML and verified exact rule scopes; checked the final Grype tables from all 18 failed jobs in https://github.com/wodby/python/actions/runs/35490493838 and confirmed every blocking High/Critical finding is CVE-2026-82049 on one of these three versions. All six Python 3.13 variants already pass with the existing rule.
git diff --checkpassed. Fresh validation passed: all 30 image build/scan jobs succeeded in https://github.com/wodby/python/actions/runs/35490828841, including all 18 previously failing variants. The PR publishing job is correctly skipped.Cleanup: remove each exact-version rule when its release line adopts a fixed official image. Issue #12 currently describes only Python 3.13; attempts to expand its body or add a comment were rejected by GitHub token permissions. This PR records the additional 3.10, 3.11, and 3.12 cleanup scope.