Repository navigation
fix: ignore CVE-2026-119170 for Python 3.14.10 in Grype scan - #1338
Merged
Merged
Conversation
Fixed in Python 3.14.11, which has no python:3.14-slim image yet. The hashlib FIPS regression only applies with OpenSSL in FIPS mode, which our images do not enable. Scoped to python 3.14.10 and mirrors the entry in HHS/simpler-grants-gov. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01LdT8aeqecw7vfghP7DbtkX
benbrasso
pushed a commit
that referenced
this pull request
Nov 12, 2026
🤖 I have created a release *beep* *boop* --- ## [3.58.1](nofos-v3.58.0...nofos-v3.58.1) (2026-11-12) ### Bug Fixes * ignore CVE-2026-119170 for Python 3.14.10 in Grype scan ([#1338](#1338)) ([8c62497](8c62497)) * show Readability Checker upload notice as a slim info alert above the file input ([#1332](#1332)) ([9989781](9989781)) * stack Readability Checker and Builder footer links in one column on small screens ([#1340](#1340)) ([32e99f8](32e99f8)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The Anchore/Grype scan fails on a High finding against the Python runtime in our base image:
The fix ships in Python 3.14.11, but there is no
python:3.14-slimimage for it yet (Docker Hub's latest is 3.14.10), so the base image can't be upgraded. This adds a temporary.grype.ymlexception:python3.14.10 (binary). It stops matching once the base image moves to 3.14.11, so a stale entry can't hide a later regression.CVE-2026-103995 (Low, fixed only in 3.16.0) also appears in the scan output. It is below the
mediumfail threshold, so it needs no change.Remove this entry once
python:3.14-slimships 3.14.11 or later and the scan passes without it.Test plan
.grype.ymlparses and the new entry is limited topython3.14.10 (binary)UI evidence
No UI changes.
Checklist
make test)