optimizely / agent

87%

LAST BUILD ON BRANCH master

branch: master

CHANGE BRANCH

x

Reset

• master
• Mat001-patch-1
• Mat001-patch-1-temp
• Mat001-patch-2
• Mat001-patch-3
• dependabot/go_modules/github.com/golang-jwt/jwt/v4-4.5.2
• dependabot/go_modules/github.com/optimizely/go-sdk/v2-2.3.1
• dependabot/go_modules/golang.org/x/crypto-0.31.0
• esra/FSSDK-12170_fix_dependabot_agent
• esra/FSSDK-12170_fix_dependabot_agent_2
• junaed/fssdk-11071-dependabot-full-sdk-review
• mpirnovar-add-holdouts-support
• mpirnovar-agent-dependabot-fssdk-11471
• mpirnovar-agent-ho-release-prep
• mpirnovar-agent-release-4.2.0
• mpirnovar-arnica-fix-fssdk-12312
• mpirnovar-cmab-accept-tests-fssdk-11725
• mpirnovar-cmab-agent-changelog
• mpirnovar-cmab-config-fssdk-11587
• mpirnovar-cmab-redis-cache-fssdk-11990
• mpirnovar-crypto-prisma-fix-fssdk-11339
• mpirnovar-dependabot-gosdk
• mpirnovar-experid-variationid-fssdk-11452
• mpirnovar-fix-client-cmabconfig-fssdk-11980
• mpirnovar-fssdk-11338
• mpirnovar-linter-fssdk-11780
• mpirnovar-prismafix-fssdk-12108
• mpirnovar-redisstreams-to-cmab-fssdk-12072
• mpirnovar-switch-acceptance-tests-sdkkey
• redis-streams-notifications
• refs/tags/v3.0.0
• refs/tags/v3.0.1
• refs/tags/v4.0.0
• refs/tags/v4.0.0-beta
• refs/tags/v4.1.0
• refs/tags/v4.2.0
• refs/tags/v4.2.2
• refs/tags/v4.3.0
• refs/tags/v4.3.0-beta.1
• refs/tags/v4.4.0
• release/v4.2.1
• v2.0.0
• v2.0.0-beta
• v2.0.0-beta1
• v2.0.0-beta2
• v2.0.0-beta3
• v2.0.1
• v2.1.0
• v2.2.0
• v2.3.0
• v2.3.1
• v2.4.0
• v2.5.0
• v2.6.0
• v2.7.0
• v2.7.1

Build # 22243102089

Build Type

push

github

Committed by web-flow

Commit Message

[FSSDK-12312] Fix Arnica security vulnerabilities (#460)

* [FSSDK-12312] Fix Arnica security vulnerabilities

- Remove sourceclear job from GitHub workflows (CWE-506 curl|bash)
- Add persist-credentials: false to all checkout actions (CWE-256, CWE-522)
- Add security documentation to OpenAPI specs (webhook.yaml, openapi.yaml)
- Add maxItems: 1000000 to all OpenAPI arrays with explanatory comment
- Remove chardet (LGPL-3.0) from examples/requirements.txt
- Remove pytest-clarity (low reputation) from tests/acceptance/requirements.txt
- Upgrade go-kit/kit to v0.13.0

Note: gohistogram dependency flagged by Arnica but accepted as it has no
known CVEs and is feature-complete/stable (indirect dependency via go-kit).

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* Remove pytest-clarity --diff-symbols flag from acceptance tests

The --diff-symbols flag was provided by pytest-clarity which was removed
in the previous commit due to low package reputation (Arnica security scan).

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>

Run Details

3480 of 4014 relevant lines covered (86.7%)

2527.86 hits per line