fix(security): resolve code-scanning and Dependabot alerts

[ajitpratap0]

Type of Change

• Bug fix (non-breaking change which fixes an issue)

Performance Impact

• No performance impact. No parser, tokenizer or AST code changed; only dependency versions and CI config.

Testing

• Unit tests pass (go test ./...)
• Race condition tests pass (task check runs test:race)
• No new Go tests. The only behaviour change is the website slug check, verified with tsc and next build.

Summary

Fixes 126 of the 134 open code-scanning alerts. The other 8 can't be fixed in code (see below).

Alerts	Fix
76 unpinned actions (#140–#215)	Every uses: in all 17 workflows is pinned to a full commit SHA with a version comment. Each SHA is the commit the old floating tag pointed to, so the action code is unchanged.
7 unpinned install commands (#216–#222)	Task and govulncheck installs use exact versions instead of @latest. The Sentry pip install uses .github/scripts/requirements-sentry.txt with hashes. The vsce and Vercel CLI installs run npm ci from lockfiles.
32 token permission alerts (#129–#139, #223–#242)	Every workflow has a read-only top-level permissions:. Write access is set only on the jobs that need it (security scans, release, glama-sync, sentry sync, stale, labeler).
3 blog XSS alerts (#243–#245)	Blog slugs are checked against a strict pattern when posts load, and links are built through one helper (website/src/lib/blog-slug.ts). The sitemap is fixed too.
3 Dockerfile alerts (#214, #215, #63)	Base images pinned by digest. Added HEALTHCHECK NONE because the distroless image has no shell or curl.
1 committed binary (#77)	examples/cmd/cmd untracked and added to .gitignore.
4 dependency alerts (#65, #112, #122–#124)	OpenTelemetry v1.47.0, edwards25519 v1.1.1, x/sys v0.49.0.

Still open:

• fix: Update CI build workflow to use Go 1.23 #113 (x/crypto): no fixed release exists yet.
• feat: Add Go Testing Framework Helpers (closes #74) #93, feat: Add SARIF Output and PR Comment Integration for GitHub Action #94 (gosqlx.wasm): kept in the repo because Vercel's build doesn't produce them.
• CLI-009: Language Server Protocol (LSP) Implementation #76, FEAT-009: Additional SQL Dialects (Snowflake, BigQuery, Redshift) #80, FEAT-011: Query Optimization Suggestions #81: repository settings and process (branch protection, best-practices badge, review rate).
• FEAT-012: Schema-Aware Validation #82: an overall vulnerability count that should drop once this merges.

Test Plan

• task check (fmt, vet, lint, race tests) passes.
• go build and go test -race pass in integrations/opentelemetry.
• tsc --noEmit passes in website/, and next build generates all pages. All 17 existing blog slugs match the new pattern.
• actionlint passes and all 17 workflows parse as YAML.
• A grep finds no uses: left without a SHA pin.
• CI runs green on this PR. None of the changed workflows has run on GitHub yet.
• After merge, the scanners re-run and the 126 alerts close.

Breaking Changes

None for library users. CI changes:

• The vsce and Vercel CLI versions are now fixed (3.7.1 and 60.1.3) instead of the newest release.
• The VS Code publish job now checks out the vscode-extension folder.
• Dependabot doesn't watch the two new pinned files (the Sentry requirements file and the Vercel lockfile in .github/tools/vercel/), so they need entries in .github/dependabot.yml or manual updates.

Dependabot alerts (commit 907b9d7)

Fixes 129 of the 131 open Dependabot alerts.

Manifest	Alerts	Fix
go.mod	#1–#9	otel, edwards25519 (first commit). buger/jsonparser v1.6.1. testcontainers-go v0.44.0, which replaces github.com/docker/docker (no patched release) with the moby/moby modules.
website/	#69–#148 except #142	next 16.1.7 → 16.3.8 (2 critical), @sentry/nextjs → ^10.76.2 (patched OpenTelemetry instrumentations), npm audit fix, and a postcss-selector-parser ^7.1.6 override under @tailwindcss/typography.
vscode-extension/ (dev only)	#12–#66	npm audit fix, plus overrides for serialize-javascript ^7.0.5 and ESLint's nested minimatch ^9.0.9.

Still open: #142 sprintf-js (via gray-matter → js-yaml@3 → argparse@1) has no patched release. gray-matter doesn't use the affected code path, but argparse still loads sprintf-js.

Vercel CLI lockfile (new in this PR): Vercel CLI pins its own dependencies, and even the newest release (63.1.2) has 33 known vulnerabilities. I added same-major overrides for tar, path-to-regexp, smol-toml, js-yaml, ajv, minimatch, undici and @tootallnate/once. @fastify/busboy (fixed only in a new major) and braces (no fix) remain, so Dependabot will raise new alerts for those. Before this PR, the same packages were installed unpinned with npm install -g and just weren't visible.

Dependabot testing:

• go build ./..., and the race tests in pkg/schema/... and pkg/mcp compile and pass. The container tests probably skipped locally without Docker.
• tsc --noEmit and next build pass for the website, and the prose styles are still in the built CSS.
• vscode-extension compiles. Its 12 lint errors already exist on main.
• A script checking each open alert against the new lockfiles finds only [Parser] Add DISTINCT keyword support #142 still vulnerable.
• Vercel CLI 60.1.3 with the overrides runs --version and --help.
• vercel build and vercel deploy with the overrides only run on main, so the first deploy after merge is the real test.

🤖 Generated with Claude Code

https://claude.ai/code/session_01A1rUqknXo3RVxa3jGASwDq

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
gosqlx-website	Ready	Preview	Oct 10, 2026 8:05pm UTC

[github-actions]

Claude finished @ajitpratap0's task in 32s —— View job

---

Review of PR #567: code-scanning alerts

I read the diff for the Dockerfile, the blog changes, the security.yml and vscode-publish.yml workflows, and the pinning pattern. I did not run CI, the build, or the tests. I also did not check the SHAs against upstream, because I had no network access.

Overall the change is sound and well scoped. The permissions model is correct: a read-only top level, with write access only on the jobs that need it. I found nothing blocking. These are the points I'd check before merging.

Things to verify

1. Version comments on the pins.
   • actions/checkout, actions/setup-node and actions/setup-go each get a single SHA across many workflows. The comments read # v4.4.0 for checkout and # v4.4.0 for setup-node. I'm not sure a checkout v4.4.0 exists, because I recall v4 releases ending around 4.3.x. A wrong comment is cosmetic, but Dependabot and Renovate use it for updates.
   • Please run something like gh api repos/actions/checkout/git/ref/tags/v4.4.0 for each unique SHA to confirm the SHA matches the tag in the comment. Pinning a SHA that doesn't belong to the tagged release is the classic supply-chain mistake.
   • codeql-action appears at both v4.38.3 (upload-sarif) and v3.38.3. Check that the second is intentional.
2. vscode-publish.yml publish job.
   • The job checks out only vscode-extension and runs npm ci, which uses vscode-extension/package-lock.json. That file exists and @vscode/vsce is ^3.7.1, so the pin to 3.7.1 comes from the lockfile and I expect it to work.
   • This is the first run of that path, so please do a workflow_dispatch dry run, or at least a local npm ci && vsce --version.
   • The checkout is placed after setup-node, so npm ci has no npm cache and there are no cache-dependency-path settings. That's fine.
   • The matrix build job still runs npx vsce package with no pin, so that path remains an unpinned install. Consider npm ci there too (the unpinned npx vsce path is not covered by the alerts you listed, but it is the same class of issue).
3. website.yml. npm ci --prefix .github/tools/vercel then adding node_modules/.bin to GITHUB_PATH is correct. The Vercel token is passed on the command line (--token=${{ secrets... }}). Passing it via the VERCEL_TOKEN env var instead would keep it out of the process arguments and out of any shell-expansion injection risk. This is optional, not new in this PR.
4. Dependabot gap. The PR notes that requirements-sentry.txt and .github/tools/vercel aren't watched. Both are one-line additions to .github/dependabot.yml (pip for /.github/scripts, npm for /.github/tools/vercel). I'd include them here so the pins don't rot, since the hash pins will otherwise go stale silently.
5. security.yml. The dependency-review and govulncheck jobs inherit the read-only top level. dependency-review-action works with contents: read. On private forks it can need pull-requests: write only if you enable PR comments, which isn't configured here. Fine.

Code and Docker

• Blog slug validation (website/src/lib/blog-slug.ts)
  • The regex is strict, the length is capped, and the type guard is correct.
  • blogPostHref throws on a bad slug. Since getPostSlugs already filters, that can only fire on a programming error, which is the right behavior. A single malformed filename can't break the build, because invalid files are silently dropped.
  • Silently dropping files means a typo'd filename (e.g. V1-14.md or my_post.md) would just vanish from the site. Consider a console.warn in getPostSlugs for skipped files.
  • page.tsx imports blogPostHref from @/lib/blog, which re-exports it, while BlogList.tsx (a client component) imports from blog-slug. That's correct, since blog.ts pulls in fs.
  • encodeURIComponent is redundant after the regex, but harmless defense in depth.
  • There are no unit tests for the validator. A tiny test table (../x, a--b, A, an empty string, javascript:) would document the intent, if the website has a test runner.
  • generateStaticParams and generateMetadata in [slug]/page.tsx already go through getPostBySlug, so a bad slug gives notFound().
• Dockerfile
  • Digest pinning is good.
  • HEALTHCHECK NONE only silences the scanner. It doesn't add a health check, and the comment says so honestly. That's acceptable for distroless. If you want a real in-image check later, add a --healthcheck flag to gosqlx-mcp.
  • Digests go stale, so make sure Dependabot's docker ecosystem covers the root Dockerfile.
• Dependencies: the bumps (OpenTelemetry, edwards25519, x/sys) look routine. task check and the OTel module's tests passed per your test plan. The integrations/opentelemetry module has its own go.mod, so confirm integrations.yml runs it in CI.
• Binary removal: examples/cmd/cmd is untracked and gitignored with an anchored path. Good. It stays in history, but that is not worth rewriting.

Process notes

• The PR can't prove the workflows work, because none has run on GitHub yet. Watch the first CI run closely, especially vscode-publish, website, sentry-to-github (pip --require-hashes fails if any transitive dependency is missing a hash) and the release workflow, whose permissions are the easiest to under-grant.
• I did not run the Go tests. CLAUDE.md requires task test:race, which you reported as passing.
  · branch fix/code-scanning-alerts

[github-actions]

Claude finished @ajitpratap0's task in 22s —— View job

---

Review of PR #567: code-scanning alerts

I found nothing blocking. I could not verify the SHAs, run CI or run the tests, because I had no network access. origin/main...HEAD also reported no merge base in this checkout, so I read the files on the branch directly instead of the full diff.

Things to verify before merge

1. Pin SHAs against their comment tags.
   • actions/checkout is pinned to 11d5960a… with the comment # v4.4.0, in 32 places. I'm not sure that tag exists, since I recall the v4 line ending around 4.2.x/4.3.x. actions/setup-node also reads # v4.4.0.
   • A wrong comment is cosmetic, but a SHA that doesn't belong to the tagged release is the classic supply-chain mistake. Check each unique SHA, for example with gh api repos/actions/checkout/git/ref/tags/v4.4.0 --jq .object.sha.
   • codeql-action/upload-sarif appears at two different SHAs, v4.38.3 (3 uses) and v3.38.3 (1 use). Please confirm the split is intentional, because v3.38.3 and v4.38.3 look like a typo or mix-up. Align them to a single pin if so.
2. Dependabot coverage.
   • .github/dependabot.yml only has gomod and github-actions. SHA pins, the digest-pinned Dockerfile, requirements-sentry.txt, .github/tools/vercel, vscode-extension and website will all go stale silently.
   • Add entries for docker (/), pip (/.github/scripts) and npm (/.github/tools/vercel, /vscode-extension, /website). The gomod entry for /integrations/opentelemetry is worth checking too.
   • Dependabot can update both the SHA and the version comment for github-actions.
3. vscode-publish.yml. The publish job's npm ci path is new and has never run. Do a workflow_dispatch dry run, or at least run npm ci && npx vsce --version locally. The matrix build job still runs an unpinned npx vsce package, which is the same class of issue.
4. sentry-to-github.yml. pip install --require-hashes fails if any transitive dependency lacks a hash. Check that the first run is green.
5. release.yml. Its permissions are the easiest to under-grant. Watch the first tag run, since goreleaser needs contents: write and may need packages or id-token depending on your config.
6. Token on the command line (optional, not new). website.yml passes the Vercel token as --token=${{ secrets… }}. Setting VERCEL_TOKEN in env instead keeps it out of process arguments.

Code

• website/src/lib/blog-slug.ts
  • The regex is strict, the length is capped, and the type guard is correct. blogPostHref throws on a bad slug, which is the right failure for a programming error.
  • encodeURIComponent is redundant after the regex but harmless.
  • getPostSlugs silently drops files that fail validation, so a typo'd filename like V1-14.md or my_post.md just disappears from the site. Add a console.warn for skipped files.
  • There are no tests for the validator. A small table (../x, a--b, A, an empty string, javascript:) would document the intent, if the website has a test runner.
• Dockerfile
  • Digest pinning is good.
  • HEALTHCHECK NONE only silences the scanner. It doesn't add a health check, and your comment says so. Adding a --healthcheck flag to the binary would give a real check later.
• Dependencies: the bumps are routine. The integrations/opentelemetry module has its own go.mod, so confirm integrations.yml runs its tests in CI.
• Binary removal: the anchored .gitignore entry for examples/cmd/cmd is correct.

Test coverage

No Go code changed, so no new Go tests are needed. The CLAUDE.md task test:race requirement was reported as passing in the PR description. The workflow changes can only be validated by their first CI run.
· branch fix/code-scanning-alerts

[github-actions]

Claude finished @ajitpratap0's task in 17s —— View job

---

Review of PR #567: code-scanning and Dependabot alerts

I found nothing blocking. I read the pinned uses: lines, .github/dependabot.yml and website/src/lib/blog-slug.ts. I did not run CI, the build or the tests, and I had no network access to check SHAs against upstream.

Things to check before merge

1. Version comments on the pins.
   • actions/checkout and actions/setup-node are both commented # v4.4.0.
   • upload-sarif is pinned at two SHAs: 24c5418… (# v4.38.3, 3 uses) and 9f759ee… (# v3.38.3, 1 use). The two versions differ in major, so one of them looks like a typo. Align them to one SHA unless the split is intentional.
   • Verify each unique SHA against its tag, e.g. gh api repos/actions/checkout/git/ref/tags/v4.4.0 --jq .object.sha. A wrong comment is cosmetic, but a SHA that doesn't belong to its tag is a supply-chain risk.
2. Dependabot coverage.
   • .github/dependabot.yml only watches gomod (/) and github-actions.
   • The new pins will go stale silently: the Dockerfile digests, .github/scripts/requirements-sentry.txt and .github/tools/vercel.
   • The integrations/opentelemetry module and the npm manifests in website/ and vscode-extension/ aren't watched either.
   • Add docker (/), pip (/.github/scripts), and npm for /.github/tools/vercel, /website and /vscode-extension. Also add gomod for /integrations/opentelemetry.
   • I could not edit workflow files, but dependabot.yml is outside .github/workflows. I haven't changed it, because you only asked for a review.
3. First-run risks. None of the changed workflows has run on GitHub yet, so these are the ones to watch:
   • vscode-publish: the publish job's npm ci path is new. Its build job still runs an unpinned npx vsce package.
   • sentry-to-github: pip --require-hashes fails if any transitive dependency lacks a hash.
   • release: permissions are easiest to under-grant here. Check that goreleaser has what it needs.
   • website: the first deploy after merge is the real test of the Vercel overrides.
4. Optional (not new). website.yml passes the Vercel token as --token=…. Setting VERCEL_TOKEN in env keeps it out of process arguments.

Code

• website/src/lib/blog-slug.ts
  • The regex is strict, the length is capped and the type guard is correct.
  • blogPostHref throws on a bad slug, which is the right failure for a programming error. encodeURIComponent is redundant after the regex but harmless.
  • getPostSlugs silently drops invalid filenames, so a typo'd file such as V1-14.md would vanish from the site. Add a console.warn for skipped files.
  • There are no tests for the validator. A small table (../x, a--b, A, empty string, javascript:) would document the intent, if the website has a test runner.
• Dockerfile: digest pinning is good. HEALTHCHECK NONE only silences the scanner, and the comment says so. A --healthcheck flag on gosqlx-mcp would give a real check later.
• Dependencies and binary removal:
  • The bumps look routine. Confirm integrations.yml runs the separate integrations/opentelemetry module.
  • The anchored .gitignore entry for examples/cmd/cmd is correct.
• Tests: no Go code changed, so no new Go tests are needed. The task check and race results come from your PR description, and I didn't re-run them.
  · branch fix/code-scanning-alerts

[github-actions]

Claude finished @ajitpratap0's task in 17s —— View job

---

Review of PR #567: code-scanning and Dependabot alerts

I found nothing blocking. I read the uses: pins in all workflows, .github/dependabot.yml and website/src/lib/blog-slug.ts. I didn't run CI, builds or tests, and I couldn't check SHAs against upstream.

To check before merge

1. Pin comments that look wrong.
   • actions/checkout@11d5960a… is commented # v4.4.0 (31 uses). actions/setup-node@49933ea5… is also # v4.4.0. I don't remember a checkout v4.4.0, so confirm each SHA matches its tag, e.g. gh api repos/actions/checkout/git/ref/tags/v4.4.0 --jq .object.sha. A wrong comment is cosmetic, but a SHA that isn't the tagged release is a supply-chain risk.
   • github/codeql-action/upload-sarif is pinned at two SHAs: 24c5418… (# v4.38.3, 3 uses) and 9f759ee… (# v3.38.3, 1 use). The two majors differ, so one looks like a mix-up. Align them unless the split is intentional.
2. Dependabot coverage (the PR description already flags this).
   • .github/dependabot.yml has only gomod (/) and github-actions.
   • So the new pins will go stale silently: Dockerfile digests, .github/scripts/requirements-sentry.txt, .github/tools/vercel, and the website/ and vscode-extension/ npm manifests. integrations/opentelemetry isn't watched either.
   • Add docker (/), pip (/.github/scripts), npm for /.github/tools/vercel, /website and /vscode-extension, and gomod for /integrations/opentelemetry. I haven't made this change because you asked for a review.
3. First-run risks. None of the changed workflows has run on GitHub yet. Watch these:
   • vscode-publish: the new npm ci path is untested. The build job still runs an unpinned npx vsce package.
   • sentry-to-github: pip --require-hashes fails if any transitive dependency lacks a hash.
   • release: permissions are the easiest to under-grant. Check goreleaser still has what it needs.
   • website: the first deploy after merge is the real test of the Vercel overrides.
4. Optional (not new). website.yml passes the Vercel token as --token=…. Setting VERCEL_TOKEN in env keeps it out of process arguments.

Code

• website/src/lib/blog-slug.ts
  • The regex is strict, the length is capped and the type guard is correct. Throwing in blogPostHref is right for a programming error. encodeURIComponent is redundant after the regex but harmless.
  • getPostSlugs silently drops invalid filenames, so a typo'd file such as V1-14.md would vanish from the site. Add a console.warn for skipped files.
  • There are no tests for the validator. A small table (../x, a--b, A, empty string, javascript:) would document the intent, if the website has a test runner.
• Dockerfile: digest pinning is good. HEALTHCHECK NONE only silences the scanner, and the comment says so.
• Dependencies and cleanup: the bumps look routine. Confirm integrations.yml runs the separate integrations/opentelemetry module. The anchored .gitignore entry for examples/cmd/cmd is correct.
• Tests: no Go code changed, so no new Go tests are needed. The task check and race results come from your PR description, and I didn't re-run them.
  · branch fix/code-scanning-alerts