CERBERUS/kitty
1
0
Fork 0
mirror of https://github.com/kovidgoyal/kitty.git synced 2026-08-04 06:36:24 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Ignore inapplicable CVEs
Some checks failed
CI / Linux (python=3.14 cc=clang sanitize=1) (push) Has been cancelled
Details
CI / Linux (python=3.12 cc=gcc sanitize=0) (push) Has been cancelled
Details
CI / Linux (python=3.13 cc=gcc sanitize=1) (push) Has been cancelled
Details
CI / Linux package (push) Has been cancelled
Details
CI / Bundle test (macos-latest) (push) Has been cancelled
Details
CI / Bundle test (ubuntu-latest) (push) Has been cancelled
Details
CI / macOS Brew (push) Has been cancelled
Details
CI / Test ./dev.sh and benchmark (push) Has been cancelled
Details
CodeQL / CodeQL-Build (actions, ubuntu-latest) (push) Has been cancelled
Details
CodeQL / CodeQL-Build (c, macos-latest) (push) Has been cancelled
Details
CodeQL / CodeQL-Build (c, ubuntu-latest) (push) Has been cancelled
Details
CodeQL / CodeQL-Build (go, ubuntu-latest) (push) Has been cancelled
Details
CodeQL / CodeQL-Build (python, ubuntu-latest) (push) Has been cancelled
Details
Depscan / Scan dependencies for vulnerabilities (push) Has been cancelled
Details

Browse source
This commit is contained in:
Kovid Goyal 2026-07-30 21:07:26 +05:30
parent 2cb1d95c3a
commit 999cde66db
No known key found for this signature in database
GPG key ID: 06BC317B515ACE7C
1 changed files with 16 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

24
.github/workflows/ci.py vendored
View file

@ -56,6 +56,7 @@ def run(*a: str, print_crash_reports: bool = False) -> None:
if ret != 0:
if ret < 0:
import signal
try:
sig = signal.Signals(-ret)
except ValueError:
@ -110,15 +111,18 @@ def install_deps() -> None:
openssl = 'openssl'
items.remove('go') # already installed by ci.yml
import ssl
if ssl.OPENSSL_VERSION_INFO[0] == 1:
openssl += '@1.1'
run('brew', 'install', 'fish', openssl, *items)
else:
run('sudo apt-get update')
run('sudo apt-get install -y --fix-missing libgl1-mesa-dev libxi-dev libxrandr-dev libxinerama-dev ca-certificates'
run(
'sudo apt-get install -y --fix-missing libgl1-mesa-dev libxi-dev libxrandr-dev libxinerama-dev ca-certificates'
' libxcursor-dev libxcb-xkb-dev libdbus-1-dev libxkbcommon-dev libharfbuzz-dev libx11-xcb-dev zsh'
' libpng-dev liblcms2-dev libfontconfig-dev libxkbcommon-x11-dev libcanberra-dev libxxhash-dev uuid-dev'
' libsimde-dev libsystemd-dev libcairo2-dev zsh bash dash systemd-coredump gdb')
' libsimde-dev libsystemd-dev libcairo2-dev zsh bash dash systemd-coredump gdb'
)
# for some reason these directories are world writable which causes zsh
# compinit to break
run('sudo chmod -R og-w /usr/share/zsh')
@ -212,11 +216,11 @@ def install_grype(exe: str = '/tmp/grype') -> str:
IGNORED_DEPENDENCY_CVES = [
# Python stdlib
'CVE-2025-8194', # DoS in tarfile
'CVE-2025-6069', # DoS in HTMLParser
'CVE-2025-13836', # DoS in http client reading from malicious server
'CVE-2025-12084', # DoS in xml.dom.minidom unused in kitty
'CVE-2025-13837', # DoS in plistlib reading plist. We only use plistlib for writing
'CVE-2025-8194', # DoS in tarfile
'CVE-2025-6069', # DoS in HTMLParser
'CVE-2025-13836', # DoS in http client reading from malicious server
'CVE-2025-12084', # DoS in xml.dom.minidom unused in kitty
'CVE-2025-13837', # DoS in plistlib reading plist. We only use plistlib for writing
'CVE-2025-6075', # Quadratic complexity in os.path.expandvars()
# python stdlib all these are erroneously marked as fixed in python 3.15
# when it hasnt even been released. Sigh.
@ -238,8 +242,11 @@ IGNORED_DEPENDENCY_CVES = [
'CVE-2026-7774', # tarfile.data_filter path traversal bypass
'CVE-2026-12003', # bug in release builds irrelevant to us
'CVE-2026-15308', # bug in stdlib html parser irrelevant to us
'CVE-2026-11940', # tarfile, unused
'CVE-2026-11972', # tarfile, unused
'CVE-2026-0864', # configparser unused
# github.com/nwaples/rardecode/v2
'CVE-2025-11579', # rardecode is version 2.2.1, not vulnerable
'CVE-2025-11579', # rardecode is version 2.2.1, not vulnerable
'CVE-2026-2673', # openssl fix not released
]
@ -261,6 +268,7 @@ def check_dependencies() -> None:
raise SystemExit('grype found problems during filesystem scan')
# Now test against the SBOM
import runpy
orig = sys.argv, sys.stdout
sys.argv = ['bypy', 'sbom', 'kovidgoyal/kitty', '1.0.0']
buf = io.StringIO()