feat: add Seal Security patched-package lockfiles - #42
Merged
Conversation
Add lockfiles containing Seal Security patched packages, mixed with standard packages so both the vendor buckets (e.g. "seal npm::") and the standard ecosystem buckets are exercised in one scan: - seal/package-lock.json: @seal-security/ejs 2.7.4-sp1 (npm alias install form) + lodash 4.17.21 - seal/requirements.txt: seal-django 3.2.18+sp1 + requests 2.32.3 - seal/go.mod: replace directive to sealsecurity.io/golang.org/x/crypto v0.26.0-sp1 Detection requires future-architect/vuls#2596. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Adds new integration-test lockfiles that include Seal Security “patched-package” coordinates so the Vuls/Trivy vendor-advisory detection path can be exercised end-to-end via the existing pseudo-server scanning flow.
Changes:
- Add Seal-patched sample lockfiles for npm (
package-lock.json), pip (requirements.txt), and Go modules (go.modwithreplace). - Register three new pseudo servers (
seal-npm,seal-pip,seal-gomod) in both integration config variants so the new lockfiles are scanned.
Reviewed changes
Copilot reviewed 4 out of 5 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| int-config.toml | Adds pseudo servers pointing at the new Seal lockfiles so they are included in the default integration scan set. |
| int-redis-config.toml | Mirrors the same new pseudo servers for the Redis-backed integration configuration. |
| data/lockfile/seal/requirements.txt | Adds a pip requirements sample with one standard package and one Seal-patched package. |
| data/lockfile/seal/package-lock.json | Adds an npm lockfile v3 sample mixing a standard dependency and a Seal-patched alias dependency. |
| data/lockfile/seal/go.mod | Adds a Go module sample using replace to point golang.org/x/crypto at a Seal-patched module path/version. |
Files not reviewed (1)
- data/lockfile/seal/package-lock.json: Generated file
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
shino
added a commit
to future-architect/vuls
that referenced
this pull request
Jul 6, 2026
… make diff Add the seal/* lockfiles introduced in vulsio/integration#42 to the AnalyzeLibrary golden test and to the LIBS servers used by make diff / diff-redis / diff-rdb-redis (server entries seal-npm/seal-pip/seal-gomod were added to int-config.toml in the same integration PR). The CI integration checkout is pinned to the integration PR head for now; re-pin to the vulsio/integration main SHA once #42 is merged, together with the submodule pointer bump. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
shino
added a commit
to future-architect/vuls
that referenced
this pull request
Jul 6, 2026
The test workflow checks out vulsio/integration at the SHA pinned in test.yml, so the committed submodule gitlink must match that pin or "go mod tidy && git diff --exit-code" fails on the dirty submodule. Point both at the vulsio/integration#42 head; re-pin both to the merged main SHA once that PR lands. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
shino
added a commit
to future-architect/vuls
that referenced
this pull request
Jul 6, 2026
…main vulsio/integration#42 is merged; point both the CI checkout pin and the submodule gitlink at the squash-merged main commit instead of the PR head. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
shino
added a commit
to future-architect/vuls
that referenced
this pull request
Jul 6, 2026
… make diff Add the seal/* lockfiles introduced in vulsio/integration#42 to the AnalyzeLibrary golden test and to the LIBS servers used by make diff / diff-redis / diff-rdb-redis (server entries seal-npm/seal-pip/seal-gomod were added to int-config.toml in the same integration PR). The CI integration checkout is pinned to the integration PR head for now; re-pin to the vulsio/integration main SHA once #42 is merged, together with the submodule pointer bump. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
shino
added a commit
to future-architect/vuls
that referenced
this pull request
Jul 6, 2026
The test workflow checks out vulsio/integration at the SHA pinned in test.yml, so the committed submodule gitlink must match that pin or "go mod tidy && git diff --exit-code" fails on the dirty submodule. Point both at the vulsio/integration#42 head; re-pin both to the merged main SHA once that PR lands. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
shino
added a commit
to future-architect/vuls
that referenced
this pull request
Jul 6, 2026
…main vulsio/integration#42 is merged; point both the CI checkout pin and the submodule gitlink at the squash-merged main commit instead of the PR head. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
shino
added a commit
to future-architect/vuls
that referenced
this pull request
Jul 7, 2026
* feat(detector): detect Seal Security patched library packages Trivy v0.71.0 introduced vendor-specific advisory detection for libraries (aquasecurity/trivy#10297), which routes packages patched by Seal Security (e.g. @seal-security/ejs, seal-django) to dedicated advisory buckets such as "seal npm::" in trivy-db. The vendor matchers are registered via a side-effect import of pkg/detector/library/all, which trivy itself does in pkg/scan/langpkg. Import it in detector so that library.NewDriver picks up the vendor routing and vuls report can detect CVEs for Seal-patched packages found in lockfiles. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(scanner): add Seal Security lockfile fixtures to golden test and make diff Add the seal/* lockfiles introduced in vulsio/integration#42 to the AnalyzeLibrary golden test and to the LIBS servers used by make diff / diff-redis / diff-rdb-redis (server entries seal-npm/seal-pip/seal-gomod were added to int-config.toml in the same integration PR). The CI integration checkout is pinned to the integration PR head for now; re-pin to the vulsio/integration main SHA once #42 is merged, together with the submodule pointer bump. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore: bump integration submodule to the seal lockfiles commit The test workflow checks out vulsio/integration at the SHA pinned in test.yml, so the committed submodule gitlink must match that pin or "go mod tidy && git diff --exit-code" fails on the dirty submodule. Point both at the vulsio/integration#42 head; re-pin both to the merged main SHA once that PR lands. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore: re-pin integration test data to the merged vulsio/integration main vulsio/integration#42 is merged; point both the CI checkout pin and the submodule gitlink at the squash-merged main commit instead of the PR head. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(detector): clarify the vendor registration import comment Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add lockfiles containing Seal Security patched packages for the vendor advisory detection introduced in trivy v0.71 (enabled in vuls by future-architect/vuls#2596).
Each file mixes a Seal-patched package with a standard one, so a single scan exercises both the vendor buckets (
seal npm::etc.) and the standard ecosystem buckets of trivy-db:seal/package-lock.json@seal-security/ejs@2.7.4-sp1(npm alias install form)lodash@4.17.21seal/requirements.txtseal-django==3.2.18+sp1requests==2.32.3seal/go.modreplace→sealsecurity.io/golang.org/x/crypto v0.26.0-sp1Package names/versions are taken from the actual seal buckets of trivy-db (2026-07-03), so each Seal package matches real advisories (e.g. CVE-2024-33883 for ejs, CVE-2024-27351 for django, CVE-2025-22869 for x/crypto). Verified end-to-end with a vuls binary built from future-architect/vuls#2596:
vuls reportdetects the seal-bucket CVEs for these lockfiles, while a master-built binary detects none of them.Server entries are added to both
int-config.tomlandint-redis-config.toml(seal-npm,seal-pip,seal-gomod).🤖 Generated with Claude Code