You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Follow-up required by #741 after the pythonsecurity:S2083 blocker tranche.
Current verified inventory
Fresh SonarQube Cloud main-branch issue API check on 2026-08-24 reports 44 open vulnerabilities and 0 remaining pythonsecurity:S2083 blockers.
Severity:
34 MAJOR
10 MINOR
0 BLOCKER
Rules:
26 × pythonsecurity:S8707
7 × python:S5332
6 × pythonsecurity:S8705
1 × pythonsecurity:S8701
1 × jssecurity:S5145
1 × javascript:S4036
1 × jssecurity:S5144
1 × jssecurity:S8476
Goal
Classify the remaining Sonar vulnerability backlog by real trust boundary and remediate valid findings in small, reviewable tranches without suppressing rules or weakening security policy.
Acceptance criteria
Retrieve exact path/line/message for all 44 findings and group them by trust boundary/root cause.
Distinguish true vulnerabilities from analyzer false positives with concrete technical evidence.
Fix valid findings at source using existing path-safety, input-validation, TLS/process-safety and logging primitives where applicable.
Add focused regression tests for each remediated boundary, including traversal/symlink/absolute/foreign-path cases where relevant.
Do not use blanket NOSONAR, global rule exclusions, or Quality Gate weakening.
Keep public MCP/API/CLI/config behavior backward compatible unless a security break is explicitly required and documented.
Run relevant unit/integration tests, Ruff, mypy, build/package checks, security lanes, CodeQL, Sonar and required CI for each tranche.
Close only when every current vulnerability is fixed or individually accepted with documented false-positive/risk justification.
Follow-up required by #741 after the
pythonsecurity:S2083blocker tranche.Current verified inventory
Fresh SonarQube Cloud main-branch issue API check on 2026-08-24 reports 44 open vulnerabilities and 0 remaining
pythonsecurity:S2083blockers.Severity:
Rules:
pythonsecurity:S8707python:S5332pythonsecurity:S8705pythonsecurity:S8701jssecurity:S5145javascript:S4036jssecurity:S5144jssecurity:S8476Goal
Classify the remaining Sonar vulnerability backlog by real trust boundary and remediate valid findings in small, reviewable tranches without suppressing rules or weakening security policy.
Acceptance criteria
NOSONAR, global rule exclusions, or Quality Gate weakening.Refs #741.