📦 deps(thirdparty): update snapshots

2026-06-23 16:03:00 +00:00
parent c4c6a41c21
commit 59e15f8999
557 changed files with 10501 additions and 3168 deletions
@@ -853,10 +853,17 @@ def _generate_markdown_report(
        lines.append("")
        lines.append("| Check | Status | Details | Scanner |")
        lines.append("|-------|--------|---------|---------|")
+        def format_status(status: str) -> str:
+            if status == "PASS":
+                return "[PASS]"
+            if status == "WARN":
+                return "[WARN]"
+            if status == "FAIL":
+                return "[FAIL]"
+            return status
+
        for item in p3.get("checklist", []):
-            status_icon = {"PASS": "[PASS]", "WARN": "[WARN]", "FAIL": "[FAIL]"}.get(
-                item["status"], item["status"]
-            )
+            status_icon = format_status(item["status"])
            lines.append(
                f"| {item['check']} | {status_icon} | {item['details']} | {item['scanner']} |"
            )
@@ -155,7 +155,7 @@ _DOCKER_COPY_SENSITIVE_RE = re.compile(
 )

 _DOCKER_CURL_PIPE_RE = re.compile(
-    r"""(?:curl|wget)\s+[^|]*\|\s*(?:bash|sh|zsh|python|perl|ruby|node)""",
+    r"""(?:curl|wget)\s+[^|]*\|\s*(?:bash|sh|zsh|python|perl|ruby|node)""",  # security-allowlist: curl-pipe-bash, wget-pipe-sh
    re.IGNORECASE,
 )

@@ -776,7 +776,7 @@ def analyze_dockerfile(filepath: Path, verbose: bool = False) -> dict:
                file=file_str,
                line=line_num,
                severity="CRITICAL",
-                description="Pipe-to-shell pattern detected (curl|bash). Remote code execution risk",
+                description="Pipe-to-shell pattern detected (curl|bash). Remote code execution risk",  # security-allowlist: curl-pipe-bash
                recommendation="Download scripts first, verify checksum, then execute",
                pattern="curl_pipe_bash",
            ))