NPA-6800: Update PR check in each repo to fail on High severity rather than Critical#134

Merged

davesmallnhs merged 14 commits into

mainfrom

task/NPA-6800/update-pr-check-to-fail-on-high-severity-rather-than-criticol

May 21, 2026

Commits on May 19, 2026

Commits on May 20, 2026

Merge branch 'main' into task/NPA-6800/update-pr-check-to-fail-on-high-severity-rather-than-criticol
davesmallnhs
authored

Commits on May 21, 2026

newman@6.2.2 requires handlebars@4.7.8 via postman-runtime@7.39.1 (postman-runtime@7.54.0 already uses handlebars@4.7.9. This override is required until newman starts using the newer postman-runtime
davesmallnhs
committed
newman@6.2.2 requires handlebars@4.7.8 via postman-runtime@7.39.1 (postman-runtime@7.54.0 already uses handlebars@4.7.9. This override is required until newman starts using the newer postman-runtime
davesmallnhs
committed
Fixed the syntax for NPM dependencies (previous was Python-style), and updated openapi-generator-cli from 2.32.0 to 2.34.0
davesmallnhs
committed
Added node-forge@1.4.0 to overrides. node-forge is now overriding what postman-runtime@7.39.1 pins, validated by postman-runtime@7.54.0
davesmallnhs
committed
Backed out of overriding individual dependencies and recognise that newman@6.2.2 pins postman-runtime@7.39.1 which has several vulnerable transitive dependencies (handlebars@4.7.8, node-forge@1.3.1…
davesmallnhs
committed
uvm (a transitive dependency of postman-sandbox) hard-pins flatted@3.3.1 which has a CVE fixed at 3.4.0. This requires an additional explicit override
davesmallnhs
committed
Override underscore to 1.13.8 to resolve GHSA-qpx9-hpmf-5gmw. postman-runtime@7.54.0 depends on httpntlm@1.8.13 which pins underscore@~1.12.1. This constraint prevents resolution to 1.13.8 which fi…
davesmallnhs
committed
Bump flatted override from 3.4.0 to 3.4.2 (GHSA-rf6f-7fwh-wjgh). 3.4.0 does not fully resolve the High severity CVE: the actual fix is 3.4.2
davesmallnhs
committed
pyjwt~=2.8.0 is vulnerable (High severity, GHSA-752w-5fwx-jx9f). Bumped to ~=2.12.0. pytest-nhsd-apim 5.0.14 hard-pins pyjwt==2.8.0, blocking the upgrade. 6.0.10 relaxes this. pytest-nhsd-apim 6.0.…
davesmallnhs
committed
update PyJWT and requests in ADR-003 example requirements.txt. Syft scans all files in the repository including documentation examples'
davesmallnhs
committed
lodash 4.17.21 and 4.17.23 appear as transitive dependencies via @apideck/portman, postman-runtime, and postman-sandbox. All constrain lodash to ^4.17.x, so npm resolves to 4.17.21/4.17.23 rather t…
davesmallnhs
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

NPA-6800: Update PR check in each repo to fail on High severity rather than Critical#134

NPA-6800: Update PR check in each repo to fail on High severity rather than Critical#134
davesmallnhs merged 14 commits into
mainfrom
task/NPA-6800/update-pr-check-to-fail-on-high-severity-rather-than-criticol

Commits on May 19, 2026

Add fail-on-severity config for scan-dependencies, which uses grype

Render vulnerabilities as a table

Commits on May 20, 2026

Merge branch 'main' into task/NPA-6800/update-pr-check-to-fail-on-high-severity-rather-than-criticol

Commits on May 21, 2026

newman@6.2.2 requires handlebars@4.7.8 via postman-runtime@7.39.1 (postman-runtime@7.54.0 already uses handlebars@4.7.9. This override is required until newman starts using the newer postman-runtime

newman@6.2.2 requires handlebars@4.7.8 via postman-runtime@7.39.1 (postman-runtime@7.54.0 already uses handlebars@4.7.9. This override is required until newman starts using the newer postman-runtime

Fixed the syntax for NPM dependencies (previous was Python-style), and updated openapi-generator-cli from 2.32.0 to 2.34.0

Added node-forge@1.4.0 to overrides. node-forge is now overriding what postman-runtime@7.39.1 pins, validated by postman-runtime@7.54.0

Backed out of overriding individual dependencies and recognise that newman@6.2.2 pins postman-runtime@7.39.1 which has several vulnerable transitive dependencies (handlebars@4.7.8, node-forge@1.3.1…

uvm (a transitive dependency of postman-sandbox) hard-pins flatted@3.3.1 which has a CVE fixed at 3.4.0. This requires an additional explicit override

Override underscore to 1.13.8 to resolve GHSA-qpx9-hpmf-5gmw. postman-runtime@7.54.0 depends on httpntlm@1.8.13 which pins underscore@~1.12.1. This constraint prevents resolution to 1.13.8 which fi…

Bump flatted override from 3.4.0 to 3.4.2 (GHSA-rf6f-7fwh-wjgh). 3.4.0 does not fully resolve the High severity CVE: the actual fix is 3.4.2

pyjwt~=2.8.0 is vulnerable (High severity, GHSA-752w-5fwx-jx9f). Bumped to ~=2.12.0. pytest-nhsd-apim 5.0.14 hard-pins pyjwt==2.8.0, blocking the upgrade. 6.0.10 relaxes this. pytest-nhsd-apim 6.0.…

update PyJWT and requests in ADR-003 example requirements.txt. Syft scans all files in the repository including documentation examples'

lodash 4.17.21 and 4.17.23 appear as transitive dependencies via @apideck/portman, postman-runtime, and postman-sandbox. All constrain lodash to ^4.17.x, so npm resolves to 4.17.21/4.17.23 rather t…