From eb2362276a03c588a3d7e0d488dee0d922daaba1 Mon Sep 17 00:00:00 2001 From: shuningc Date: Mon, 27 Jul 2026 14:27:43 -0700 Subject: [PATCH 1/4] fix(ci): require uv >=0.8.6 for VULN-95456 Pin uv to the patched floor in CI workflows and enforce required-version in splunk-ao-adk/a2a pyproject.toml. Fixes CVE-2025-54368 (ZIP parsing differentials allowing malicious package extraction). Co-authored-by: Cursor --- .github/workflows/ci-tests-splunk-ao-a2a.yaml | 1 + .github/workflows/ci-tests-splunk-ao-adk.yaml | 1 + splunk-ao-a2a/pyproject.toml | 1 + splunk-ao-adk/pyproject.toml | 1 + 4 files changed, 4 insertions(+) diff --git a/.github/workflows/ci-tests-splunk-ao-a2a.yaml b/.github/workflows/ci-tests-splunk-ao-a2a.yaml index 88498159..0d671d23 100644 --- a/.github/workflows/ci-tests-splunk-ao-a2a.yaml +++ b/.github/workflows/ci-tests-splunk-ao-a2a.yaml @@ -43,6 +43,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6 with: + version: ">=0.8.6" enable-cache: true cache-dependency-glob: "**/splunk-ao-a2a/pyproject.toml" diff --git a/.github/workflows/ci-tests-splunk-ao-adk.yaml b/.github/workflows/ci-tests-splunk-ao-adk.yaml index 43985065..241f9a23 100644 --- a/.github/workflows/ci-tests-splunk-ao-adk.yaml +++ b/.github/workflows/ci-tests-splunk-ao-adk.yaml @@ -43,6 +43,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6 with: + version: ">=0.8.6" enable-cache: true cache-dependency-glob: "**/splunk-ao-adk/pyproject.toml" diff --git a/splunk-ao-a2a/pyproject.toml b/splunk-ao-a2a/pyproject.toml index 4f9bed12..123a47ee 100644 --- a/splunk-ao-a2a/pyproject.toml +++ b/splunk-ao-a2a/pyproject.toml @@ -25,6 +25,7 @@ Repository = "https://github.com/splunk/splunk-ao-python" # UV-specific configuration (path for dev, ignored when installed from PyPI) [tool.uv] +required-version = ">=0.8.6" sources = { "splunk-ao" = { path = "../", editable = true } } [dependency-groups] diff --git a/splunk-ao-adk/pyproject.toml b/splunk-ao-adk/pyproject.toml index 1b597ef9..a91b9587 100644 --- a/splunk-ao-adk/pyproject.toml +++ b/splunk-ao-adk/pyproject.toml @@ -23,6 +23,7 @@ Repository = "https://github.com/splunk/splunk-ao-python" # UV-specific configuration (path for dev, ignored when installed from PyPI) [tool.uv] +required-version = ">=0.8.6" sources = { "splunk-ao" = { path = "../", editable = true } } [tool.hatch.build.targets.wheel] From d672edb9cd1afc057ec426e291cd59a66bc4188e Mon Sep 17 00:00:00 2001 From: shuningc Date: Thu, 30 Jul 2026 11:36:16 -0700 Subject: [PATCH 2/4] Update splunk-ao-a2a/pyproject.toml Co-authored-by: Fernando Correia --- splunk-ao-a2a/pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/splunk-ao-a2a/pyproject.toml b/splunk-ao-a2a/pyproject.toml index 123a47ee..64006c86 100644 --- a/splunk-ao-a2a/pyproject.toml +++ b/splunk-ao-a2a/pyproject.toml @@ -23,7 +23,7 @@ dependencies = [ [project.urls] Repository = "https://github.com/splunk/splunk-ao-python" -# UV-specific configuration (path for dev, ignored when installed from PyPI) +required-version = ">=0.9.6" [tool.uv] required-version = ">=0.8.6" sources = { "splunk-ao" = { path = "../", editable = true } } From 523873c8d78fa7da7d5441465ca8885db156cebc Mon Sep 17 00:00:00 2001 From: shuningc Date: Thu, 30 Jul 2026 11:36:23 -0700 Subject: [PATCH 3/4] Update .github/workflows/ci-tests-splunk-ao-a2a.yaml Co-authored-by: Fernando Correia --- .github/workflows/ci-tests-splunk-ao-a2a.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci-tests-splunk-ao-a2a.yaml b/.github/workflows/ci-tests-splunk-ao-a2a.yaml index 0d671d23..1c3f017d 100644 --- a/.github/workflows/ci-tests-splunk-ao-a2a.yaml +++ b/.github/workflows/ci-tests-splunk-ao-a2a.yaml @@ -43,7 +43,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6 with: - version: ">=0.8.6" + version: ">=0.9.6" enable-cache: true cache-dependency-glob: "**/splunk-ao-a2a/pyproject.toml" From e79ae7e8e255f4d82e869a4f1e20eb240521ad32 Mon Sep 17 00:00:00 2001 From: shuningc Date: Thu, 30 Jul 2026 11:36:29 -0700 Subject: [PATCH 4/4] Update .github/workflows/ci-tests-splunk-ao-adk.yaml Co-authored-by: Fernando Correia --- .github/workflows/ci-tests-splunk-ao-adk.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci-tests-splunk-ao-adk.yaml b/.github/workflows/ci-tests-splunk-ao-adk.yaml index 241f9a23..b7b93a13 100644 --- a/.github/workflows/ci-tests-splunk-ao-adk.yaml +++ b/.github/workflows/ci-tests-splunk-ao-adk.yaml @@ -43,7 +43,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6 with: - version: ">=0.8.6" + version: ">=0.9.6" enable-cache: true cache-dependency-glob: "**/splunk-ao-adk/pyproject.toml"