observal-cli 1.4.0__tar.gz → 1.4.2__tar.gz

observal_cli-1.4.2/.github/vex/observal.vex.json

@@ -0,0 +1,43 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@id": "https://github.com/BlazeUp-AI/Observal/blob/main/.github/vex/observal.vex.json",
+  "author": "Observal Security <contact@observal.io>",
+  "timestamp": "2026-05-31T00:00:00Z",
+  "version": 1,
+  "statements": [
+    {
+      "vulnerability": {
+        "@id": "https://github.com/pypa/advisory-database/blob/main/vulns/PYSEC-2025-183.yaml",
+        "name": "PYSEC-2025-183"
+      },
+      "products": [
+        {
+          "@id": "pkg:pypi/observal-server",
+          "subcomponents": [
+            {"@id": "pkg:pypi/starlette"}
+          ]
+        }
+      ],
+      "status": "not_affected",
+      "justification": "vulnerable_code_not_in_execute_path",
+      "impact_statement": "Observal does not use the affected Starlette multipart form parsing path that triggers this vulnerability. All file uploads are handled via dedicated streaming endpoints with size limits enforced at the nginx layer."
+    },
+    {
+      "vulnerability": {
+        "@id": "https://github.com/pypa/advisory-database/blob/main/vulns/PYSEC-2026-161.yaml",
+        "name": "PYSEC-2026-161"
+      },
+      "products": [
+        {
+          "@id": "pkg:pypi/observal-server",
+          "subcomponents": [
+            {"@id": "pkg:pypi/starlette"}
+          ]
+        }
+      ],
+      "status": "not_affected",
+      "justification": "vulnerable_code_not_in_execute_path",
+      "impact_statement": "The affected code path requires specific Host header manipulation that is blocked by Observal's nginx reverse proxy configuration (see docker/nginx.conf header validation rules)."
+    }
+  ]
+}

observal_cli-1.4.2/.github/workflows/dependency-review.yml

@@ -0,0 +1,28 @@
+# SPDX-FileCopyrightText: 2026 Kaushik Kumar <kaushikrjpm10@gmail.com>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+name: Dependency Review
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  dependency-review:
+    name: License & vulnerability gate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Dependency Review
+        uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: high
+          deny-licenses: SSPL-1.0, BUSL-1.1, Elastic-2.0
+          comment-summary-in-pr: always
+          license-check: true
+          vulnerability-check: true

{observal_cli-1.4.0 → observal_cli-1.4.2}/.github/workflows/sbom.yml

@@ -84,6 +84,14 @@ jobs:
               --label "security,automated"
           fi
 
+      # ── Generate VEX document ────────────────────────────────
+      - name: Generate VEX document
+        run: uv run --no-project scripts/generate_vex.py observal.openvex.json
+
+      # ── Generate third-party notices ─────────────────────────
+      - name: Generate third-party notices
+        run: uv run --no-project scripts/generate_third_party_notices.py THIRD_PARTY_NOTICES.md
+
       # ── Upload SBOM artifacts ────────────────────────────────
       - uses: actions/upload-artifact@v7
         with:
@@ -91,6 +99,8 @@ jobs:
           path: |
             sbom-python.cdx.json
             sbom-node.cdx.json
+            observal.openvex.json
+            THIRD_PARTY_NOTICES.md
 
       # ── Attach to release ────────────────────────────────────
       - name: Attach SBOMs to release
@@ -101,6 +111,8 @@ jobs:
           gh release upload "${{ github.event.release.tag_name }}" \
             sbom-python.cdx.json \
             sbom-node.cdx.json \
+            observal.openvex.json \
+            THIRD_PARTY_NOTICES.md \
             --clobber
 
   license-check:

{observal_cli-1.4.0 → observal_cli-1.4.2}/AGENTS.md

@@ -49,13 +49,12 @@ observal-server/       FastAPI server
     session_parsers/   Per-IDE JSONL parsers (claude_code, kiro, cursor, pi)
     audit/             HIPAA audit system (loguru-based)
     config/            Config generation helpers (mcp_builder, skill_builder)
-    insights/          Open-source insight stub (full impl in ee/)
+    insights/          Insight engine (report generation, facets, sections, HTML export)
     shared/            Cross-service utilities
   jobs/                Background job definitions (catalog, maintenance)
 
 ee/                    Enterprise (source-available, separate license)
   license.py           JWT license validation
-  observal_insights/   Full insight pipeline (~20 modules)
   observal_server/     EE routes + services (audit, SAML, SCIM, exec dashboard)
 
 web/                   Next.js 16 / React 19 frontend
@@ -189,7 +188,7 @@ Source-available, separate license. Loaded via signed JWT (`OBSERVAL_LICENSE_KEY
 
 **Critical constraint:** Core never imports from `ee/`. The `ee/` code imports core. Open-source is fully functional without a license key.
 
-Contents: `observal_insights/` (full insight pipeline), SAML SSO, SCIM provisioning, exec dashboard, HIPAA audit, license generation script.
+Contents: SAML SSO, SCIM provisioning, exec dashboard, HIPAA audit, license generation script.
 
 ## Commands