🚨 Security: Critical or high vulnerabilities in mcp-clickhouse container #1046

🚨 Security Scan Alert

A periodic security scan found fixable critical or high severity vulnerabilities in the container image. Findings at this level also block publishing in the build workflow.

• Image: ghcr.io/stacklok/dockyard/uvx/mcp-clickhouse:0.6.0
• Critical vulnerabilities: 1
• High vulnerabilities: 7

Details

See the Security tab for full details.

Critical Vulnerabilities

• GHSA-ffc3-869f-jxw9 in pyjwt@2.13.0: PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

High Vulnerabilities

• GHSA-vxq7-64xx-v4gw in urllib3@2.7.0: urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory
• GHSA-8988-9cw3-xx77 in urllib3@2.7.0: urllib3: HTTPS proxy TLS configuration may be ignored or overridden
• GHSA-r6x4-923q-g947 in pyjwt@2.13.0: PyJWT BOM Bypass
• GHSA-w2cx-738m-mc7w in pyjwt@2.13.0: PyJWT accepts public JWK containers as HMAC secrets
• GHSA-9j54-fg26-wv3r in pyjwt@2.13.0: PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation

... and 2 more. See Security tab for complete list.

Automated security scan from periodic-security-scan workflow