# Vulnerabilities Fix

This document describes how to react to vulnerabilities reported by the tools.

We have several tools checking for vulnerabilities.
* [GitHub scanner](https://docs.github.com/en/code-security/concepts/code-scanning/about-code-scanning)
* [Docker Image Scan](Jenkinsfile)
* [SonarQube](Jenkinsfile)

They check for vulnerabilities in the following areas:
* our code vulnerabilities
* dependent packages vulnerabilities
* third-party vulnerabilities

## Dependency vulnerabilities

First, they appear as `warnings` in the Jenkins build log.
As soon as `Grace Period` expires they will block the build.

They look like these entries in Jenkins log:
```
[2026-01-20T09:24:37.239Z] ###### WARNING FINDINGS: 1 ######
[2026-01-20T09:24:37.239Z] +---------------------+-------------------------------+---------------+----------+----------+--------------+
[2026-01-20T09:24:37.239Z] |   Vulnerability ID  |       Installed Version       | Fixed Version | Severity | Blocking | Grace Period |
[2026-01-20T09:24:37.239Z] +---------------------+-------------------------------+---------------+----------+----------+--------------+
[2026-01-20T09:24:37.239Z] |    CVE-2026-21441   |     pkg:pypi/urllib3@2.6.2    |     2.6.3     |   HIGH   |    No    |      2       |
[2026-01-20T09:24:37.239Z] +---------------------+-------------------------------+---------------+----------+----------+--------------+
```

Grace Period is the remaining time before the build will be blocked.

You can find the details in AWS Inspector report (the URL listed in Jenkins log for Docker Scan).
Note: use `shared` (086679231553) AWS account where our ECR repos live.

### How to fix

We need to upgrade the vulnerable package:
```
uv lock --upgrade-package urllib3
```

# Third-party vulnerabilities

Sometimes it reports vulnerabilities which we cannot fix.
It can be either OS package or third-party API tool.

In that case we need to add it's ID to list `THIRDPARTY_VULNERABILITIES` in [Jenkinsfile](Jenkinsfile)