From 8689364b48c3b77774d0b173c3e96c40a739bbd9 Mon Sep 17 00:00:00 2001 From: Reuven Harrison Date: Wed, 21 Oct 2026 18:35:27 +0300 Subject: [PATCH] bump: oasdiff v1.34.1 v1.34.1 applies the external-refs policy in the reader that --open installs, which every action that uploads a review uses. Without it allow-external-refs: false had no effect on that path, so a spec in a pull request could read a file from the runner or reach a URL, and the content went into the uploaded review. Reported-by: Zachariah Mithani (AploSec) Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_017e285CvofYf6joqC98gTXz --- breaking/Dockerfile | 2 +- changelog/Dockerfile | 2 +- diff/Dockerfile | 2 +- pr-comment/Dockerfile | 2 +- validate/Dockerfile | 2 +- verify/Dockerfile | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/breaking/Dockerfile b/breaking/Dockerfile index bef3f8e..954532a 100644 --- a/breaking/Dockerfile +++ b/breaking/Dockerfile @@ -1,4 +1,4 @@ -FROM tufin/oasdiff:v1.34.0 +FROM tufin/oasdiff:v1.34.1 RUN apk add --no-cache curl jq ENV PLATFORM github-action COPY entrypoint.sh /entrypoint.sh diff --git a/changelog/Dockerfile b/changelog/Dockerfile index bef3f8e..954532a 100644 --- a/changelog/Dockerfile +++ b/changelog/Dockerfile @@ -1,4 +1,4 @@ -FROM tufin/oasdiff:v1.34.0 +FROM tufin/oasdiff:v1.34.1 RUN apk add --no-cache curl jq ENV PLATFORM github-action COPY entrypoint.sh /entrypoint.sh diff --git a/diff/Dockerfile b/diff/Dockerfile index c9ed664..bf9cd32 100644 --- a/diff/Dockerfile +++ b/diff/Dockerfile @@ -1,4 +1,4 @@ -FROM tufin/oasdiff:v1.34.0 +FROM tufin/oasdiff:v1.34.1 ENV PLATFORM github-action COPY entrypoint.sh /entrypoint.sh ENTRYPOINT ["/entrypoint.sh"] diff --git a/pr-comment/Dockerfile b/pr-comment/Dockerfile index bef3f8e..954532a 100644 --- a/pr-comment/Dockerfile +++ b/pr-comment/Dockerfile @@ -1,4 +1,4 @@ -FROM tufin/oasdiff:v1.34.0 +FROM tufin/oasdiff:v1.34.1 RUN apk add --no-cache curl jq ENV PLATFORM github-action COPY entrypoint.sh /entrypoint.sh diff --git a/validate/Dockerfile b/validate/Dockerfile index c9ed664..bf9cd32 100644 --- a/validate/Dockerfile +++ b/validate/Dockerfile @@ -1,4 +1,4 @@ -FROM tufin/oasdiff:v1.34.0 +FROM tufin/oasdiff:v1.34.1 ENV PLATFORM github-action COPY entrypoint.sh /entrypoint.sh ENTRYPOINT ["/entrypoint.sh"] diff --git a/verify/Dockerfile b/verify/Dockerfile index bef3f8e..954532a 100644 --- a/verify/Dockerfile +++ b/verify/Dockerfile @@ -1,4 +1,4 @@ -FROM tufin/oasdiff:v1.34.0 +FROM tufin/oasdiff:v1.34.1 RUN apk add --no-cache curl jq ENV PLATFORM github-action COPY entrypoint.sh /entrypoint.sh