Matched advisory candidates (shard 3b) by BrewTestBot · Pull Request #1631 · Homebrew/advisory-database

BrewTestBot · 2026-10-24T12:35:50Z

Automated candidates via brew advisory-match --formula-list (planned workers) --new-history, sharded by formula (SHA-256 bucket 3b). See CONTRIBUTING.md for the review checklist.

Partial daily run: successful buckets only; the older standing PR may overlap.

Run and review artifacts: https://github.com/Homebrew/advisory-database/actions/runs/40657111712

coderabbitai · 2026-10-24T12:36:02Z

📝 Summary

Summary by CodeRabbit

Security Advisories
- Added advisories for several filelock vulnerabilities affecting Homebrew ggshield, including local lock races, unsafe file handling and denial-of-service risks.
- Added an advisory for a setuptools Windows path-escape vulnerability affecting Homebrew ggshield.
- Added advisories for excessive CPU use during DNS processing in certsync, ggshield and localstack, and for an OAuthLib device-code validation issue in ggshield.
- Updated existing advisories to reflect setuptools 84.2.1 as the affected resource version and refreshed their modification details.

This pull request adds security advisories for ggshield, certsync and localstack. It also updates the recorded setuptools version and evidence in two existing ggshield advisories.

Changes: ggshield advisory records

Layer / File(s)	Summary
Filelock vulnerability records `advisories/BREW-ggshield-CVE-2026-112906.json`, `advisories/BREW-ggshield-CVE-2026-112914.json`, `advisories/BREW-ggshield-CVE-2026-112937.json`, `advisories/BREW-ggshield-CVE-2026-112940.json`	Adds four advisories with affected versions, vulnerability details, severity data, evidence, workarounds and references.
Setuptools advisory records `advisories/BREW-ggshield-GHSA-xmj3-9gf7-h52w.json`, `advisories/BREW-ggshield-CVE-2025-47273.json`, `advisories/BREW-ggshield-CVE-2026-59890.json`	Adds an advisory for a Windows path-escape vulnerability and updates the setuptools version and evidence in two existing advisories.
Other dependency advisories `advisories/BREW-ggshield-CVE-2026-114605.json`, `advisories/BREW-ggshield-CVE-2026-49272.json`	Adds advisories for dnspython DNS-name decompression and oauthlib device-code grant vulnerabilities.

Other Homebrew package advisories

Layer / File(s)	Summary
certsync and localstack advisories `advisories/BREW-certsync-CVE-2026-114605.json`, `advisories/BREW-localstack-CVE-2026-114605.json`	Adds advisories describing excessive CPU use during dnspython DNS-name decompression.

Priority: Normal

Merge Risk: Moderate · up to 9d494

The new certsync and localstack advisories may flag installations that already ship the fixed dnspython, so the affected ranges should be checked against formula history before merge. The ggshield setuptools advisory may also understate its applicability by describing only the Windows path escape.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title clearly identifies the main change: adding matched advisory candidates for shard 3b.
Description check		The description explains the automated candidate generation, sharding, partial run status, possible overlap, review checklist, and run artefacts.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 1

Review info

Run configuration

Source mode: Auto
Repository: Homebrew/advisory-database
Branch: matched-advisories-3b
File: .coderabbit.config.ts
Commit: 8c1d324
Layers: Repository TS config (base), Organization UI (inherited)
Review profile: CHILL
Plan: Advanced
Run ID: c4a91799-e840-45da-b174-be54c664c792

Commits

Reviewing files that changed from the base of the PR and between 49b6e3a and 8c1d324.

Files selected for processing: 7

advisories/BREW-ggshield-CVE-2025-47273.json
advisories/BREW-ggshield-CVE-2026-112906.json
advisories/BREW-ggshield-CVE-2026-112914.json
advisories/BREW-ggshield-CVE-2026-112937.json
advisories/BREW-ggshield-CVE-2026-112940.json
advisories/BREW-ggshield-CVE-2026-59890.json
advisories/BREW-ggshield-GHSA-xmj3-9gf7-h52w.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

coderabbitai · 2026-10-27T11:32:49Z

+      }
+    ]
+  },
+  "summary": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation  Description",


Minor · Security & Privacy · Quick win

Describe the POSIX path escape as well.

On macOS and Linux, a crafted wheel can supply an absolute namespace value such as /tmp/outside. In vulnerable setuptools, os.path.join then discards destination_eggdir, and the legacy wheel installation path can write __init__.py outside it. The Windows-only summary can therefore lead Homebrew users to dismiss an applicable warning. Update the summary and details to cover POSIX paths; retain the legacy-installation condition. (raw.githubusercontent.com)

Base: 75092d1

coderabbitai

Actionable comments posted: 1

Review info

Run configuration

Source mode: Auto
Repository: Homebrew/advisory-database
Branch: matched-advisories-3b
File: .coderabbit.config.ts
Commit: 9d494a5
Layers: Repository TS config (base), Organization UI (inherited)
Review profile: CHILL
Plan: Advanced
Run ID: 7750b71e-ccab-4d06-a0cd-6a19f6b9f866

Commits

Reviewing files that changed from the base of the PR and between 532d1f0 and 9d494a5.

Files selected for processing: 11

advisories/BREW-certsync-CVE-2026-114605.json
advisories/BREW-ggshield-CVE-2025-47273.json
advisories/BREW-ggshield-CVE-2026-112906.json
advisories/BREW-ggshield-CVE-2026-112914.json
advisories/BREW-ggshield-CVE-2026-112937.json
advisories/BREW-ggshield-CVE-2026-112940.json
advisories/BREW-ggshield-CVE-2026-114605.json
advisories/BREW-ggshield-CVE-2026-49272.json
advisories/BREW-ggshield-CVE-2026-59890.json
advisories/BREW-ggshield-GHSA-xmj3-9gf7-h52w.json
advisories/BREW-localstack-CVE-2026-114605.json

Files skipped from review as they are similar to previous changes: 1

advisories/BREW-ggshield-CVE-2025-47273.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

coderabbitai · 2026-10-28T11:13:53Z

+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",


Major · Data Integrity & Integration · Quick win

Close the ranges for the fixed resource version.

This record and advisories/BREW-localstack-CVE-2026-114605.json at Lines 29–32 identify dnspython 2.9.0 as the resource. Upstream affects versions before 2.9.0 and identifies 2.9.0 as fixed. (github.com)

Both open ranges therefore report fixed installations as vulnerable. Set range_state to fixed, set fix to bump, and close each range at the first fixed Homebrew version established from formula history.

Based on learnings: an affected range of < X excludes X.

Source: Learnings

BrewTestBot force-pushed the matched-advisories-3b branch 3 times, most recently from bdf5447 to 8c1d324 Compare October 27, 2026 11:19

coderabbitai Bot reviewed Oct 27, 2026

View reviewed changes

BrewTestBot force-pushed the matched-advisories-3b branch from 8c1d324 to 532d1f0 Compare October 27, 2026 21:39

Matched advisory candidates (shard 3b)

9d494a5

Base: 75092d1

BrewTestBot force-pushed the matched-advisories-3b branch from 532d1f0 to 9d494a5 Compare October 28, 2026 11:03

coderabbitai Bot reviewed Oct 28, 2026

View reviewed changes

Navigation Menu

Repository navigation

Matched advisory candidates (shard 3b) - #1631

Matched advisory candidates (shard 3b)#1631
BrewTestBot wants to merge 1 commit into
mainfrom
matched-advisories-3b

BrewTestBot commented Oct 24, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 24, 2026 •

edited

Loading

Summary by CodeRabbit

Uh oh!

coderabbitai Bot left a comment

Uh oh!

coderabbitai Bot Oct 27, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

coderabbitai Bot Oct 28, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

BrewTestBot commented Oct 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Oct 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Oct 27, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Oct 28, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

BrewTestBot commented Oct 24, 2026 •

edited

Loading

coderabbitai Bot commented Oct 24, 2026 •

edited

Loading