LIA

Security & code-scanning remediation

Full triage of the GitHub security surface — 76 code-scanning alerts, 24 Dependabot alerts, 15 dependency PRs — every finding traced to root cause instead of patching symptoms.

Security

• Consolidated dependency bumps (24 alerts resolved): asyncssh 2.23.0 (GHSA-g794-3fmp-753h), langchain-anthropic 1.4.6 (GHSA-gr75-jv2w-4656), authlib 1.6.12, nltk 3.10.0, pygments 2.20.0 + manifest security floors (pyyaml, segno, python-pptx). Locks regenerated hash-verified, surgical diff. The 3 ecdsa alerts (Minerva, no upstream fix) dismissed with rationale: HS256-only JWT, cryptography backend, zero EC usage in src/.
• Security workflow repaired: missing actions: read permission failed every CodeQL/Trivy upload since May 11, freezing the alert baseline; now also runs on every push to main.
• Fresh-baseline follow-up: the first working scan surfaced findings accumulated during the blind window — all resolved: 8 CodeQL findings fixed at root cause (incl. RAG storage containment guard and the skills sandbox moving from world-writable 0777 to chown+0700), 11 frontend Trivy alerts fixed via pnpm overrides (dompurify 3.4.11, @grpc/grpc-js 1.14.4, protobufjs 7.6.5, @babel/core 7.29.7, vite 7.3.5).

Fixed

• Assistant: "my next N appointments" no longer over-matches the daily-briefing skill (trigger-first description rewrite), verified live in pipeline and ReAct modes.
• ReAct: the tool cap now keeps the detected domains' tools first and names every dropped tool — no more silent starvation, no more invented appointments.
• Dependabot npm scope moved to the workspace root (frontend PRs can finally pass --frozen-lockfile).

Changed

• All 193 except: pass handlers eliminated (CodeQL py/empty-except class closed) — contextlib.suppress doctrine + permanent AST guard in CI.
• Node.js 22 → 24 LTS (web Docker images + CI).

Verified

8,921 backend unit tests green · MyPy strict · Docker boot healthy on the regenerated lock · 200/200 vitest on Node 24 · i18n parity ×6 languages · post-remediation scan: 0 open Dependabot alerts, 0 open code-scanning alerts (dismissals documented).

Full changelog: CHANGELOG.md

Docker Images

docker pull ghcr.io/jgouviergmail/LIA-Assistant/api:v1.21.24
docker pull ghcr.io/jgouviergmail/LIA-Assistant/web:v1.21.24

Quick Start

git clone https://github.com/jgouviergmail/LIA-Assistant.git
cd LIA-Assistant
cp .env.example .env
docker compose up -d

Full Changelog: https://github.com/jgouviergmail/LIA-Assistant/compare/v1.21.23...v1.21.24

🤖 Generated with Claude Code