🚨 Security: Critical or high vulnerabilities in astra-db-mcp container

🚨 Security Scan Alert

A periodic security scan found fixable critical or high severity vulnerabilities in the container image. Findings at this level also block publishing in the build workflow.

• Image: ghcr.io/stacklok/dockyard/npx/astra-db-mcp:1.2.2
• Critical vulnerabilities: 0
• High vulnerabilities: 5

Details

See the Security tab for full details.

High Vulnerabilities

• GHSA-j4fx-xxwh-2485 in jsondiffpatch@0.6.0: jsondiffpatch patch APIs are vulnerable to prototype pollution
• GHSA-5jgf-p345-68v8 in fast-uri@3.1.5: fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
• GHSA-jqff-g426-hqxp in fast-uri@3.1.5: fast-uri vulnerable to host confusion via percent-encoded scheme normalization
• GHSA-f65p-4m7j-42xc in fast-uri@3.1.5: fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
• GHSA-fph4-wmhf-6fwf in fast-uri@3.1.5: fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

Automated security scan from periodic-security-scan workflow

Start with the periodic-security-scan workflow and the Security tab findings for ghcr.io/stacklok/dockyard/npx/astra-db-mcp:1.2.2. Trace where the image's jsondiffpatch and fast-uri dependencies are defined or updated, then rerun the relevant scan or build workflow. Done means the five high vulnerabilities are resolved and publishing is no longer blocked.