Security watch log

armin-bot commented

2026-11-07 20:41:53 -08:00

Owner

State for the automated daily security watch of OpenNeo/impress. Each daily run (3:45am Pacific) appends one comment; the weekly run (Sundays) posts a summary.

Comment formats

YYYY-MM-DD: clear (N ignored): nothing new
YYYY-MM-DD: PATCHED <advisory> (<package>): <PR link>: likely affects us, PR opened
YYYY-MM-DD: HELD <advisory> (<package> <version>, <scope>): <reason>: ruled out, rolled up weekly
YYYY-MM-DD: INCOMPLETE: <errors>: a check failed
Weekly summary YYYY-MM-DD: heartbeat + held items

The scan itself is bin/security-scan; reviewed ignores live in .bundler-audit.yml and .security-scan-ignore.yml.

Baseline, 2026-11-08: backlog triaged in OpenNeo/impress#12 (5 packages patched, 49 advisories held with reasons).

State for the automated daily security watch of [OpenNeo/impress](https://code.openneo.net/OpenNeo/impress). Each daily run (3:45am Pacific) appends one comment; the weekly run (Sundays) posts a summary. **Comment formats** - `YYYY-MM-DD: clear (N ignored)`: nothing new - `YYYY-MM-DD: PATCHED <advisory> (<package>): <PR link>`: likely affects us, PR opened - `YYYY-MM-DD: HELD <advisory> (<package> <version>, <scope>): <reason>`: ruled out, rolled up weekly - `YYYY-MM-DD: INCOMPLETE: <errors>`: a check failed - `Weekly summary YYYY-MM-DD`: heartbeat + held items The scan itself is `bin/security-scan`; reviewed ignores live in `.bundler-audit.yml` and `.security-scan-ignore.yml`. Baseline, 2026-11-08: backlog triaged in OpenNeo/impress#12 (5 packages patched, 49 advisories held with reasons).

armin-bot commented

2026-11-07 20:41:53 -08:00

Author

Owner

2026-11-08: clear (50 ignored). Note: Ruby 3.4.12 is out; we run 3.4.5.

armin-bot commented

2026-11-08 03:51:55 -08:00

Author

Owner

2026-11-08: clear (50 ignored). Note: Ruby 3.4.12 is out; we run 3.4.5.

armin-bot commented

2026-11-08 10:46:29 -08:00

Author

Owner

Weekly summary 2026-11-08

Heartbeat: 2 of 7 daily scans ran: 2 clear, 0 with findings, 0 incomplete. Both entries are dated 11-08 (one a duplicate), so nothing was logged for 11-02 through 11-07. The watch itself may be broken.

Live check today (bin/security-scan --osv): INCOMPLETE (exit 2). This container has no Ruby 3.4.5 (only 3.1.6, 3.2.6 and 3.3.6), so the scan died at startup with Bundler::RubyVersionMismatch. Retrying on 3.3.6 gave the same error. No advisory results from this run, and no notes or stale_ignores.

PRs opened for advisories this week: none logged.

Held advisories logged this week: none. Nothing to add to .bundler-audit.yml / .security-scan-ignore.yml.

From the last logged scans (11-08): clear, 50 ignored. Note: Ruby 3.4.12 is out and we run 3.4.5. The log didn't mention stale_ignores.

Want a general bundle update / yarn up pass this week, beyond security fixes?

Weekly summary 2026-11-08 Heartbeat: 2 of 7 daily scans ran: 2 clear, 0 with findings, 0 incomplete. Both entries are dated 11-08 (one a duplicate), so nothing was logged for 11-02 through 11-07. The watch itself may be broken. Live check today (`bin/security-scan --osv`): INCOMPLETE (exit 2). This container has no Ruby 3.4.5 (only 3.1.6, 3.2.6 and 3.3.6), so the scan died at startup with Bundler::RubyVersionMismatch. Retrying on 3.3.6 gave the same error. No advisory results from this run, and no notes or stale_ignores. PRs opened for advisories this week: none logged. Held advisories logged this week: none. Nothing to add to .bundler-audit.yml / .security-scan-ignore.yml. From the last logged scans (11-08): clear, 50 ignored. Note: Ruby 3.4.12 is out and we run 3.4.5. The log didn't mention stale_ignores. Want a general `bundle update` / `yarn up` pass this week, beyond security fixes?