Switch priority in ReleasesRepo setting - profile over env var

go.mod

@@ -14,7 +14,7 @@ require (
 	github.com/jfrog/gofrog v1.7.7
 	github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20261027135447-d76f4db4eedc
 	github.com/jfrog/jfrog-cli-security v1.41.2
-	github.com/jfrog/jfrog-client-go v1.55.1-0.20261029150622-a2075f5e551a
+	github.com/jfrog/jfrog-client-go v1.55.1-0.20261102081622-45c51cfca4f7
 	github.com/owenrumney/go-sarif/v3 v3.2.3
 	github.com/stretchr/testify v1.11.1
 	github.com/urfave/cli/v2 v2.27.7
@@ -130,7 +130,7 @@ require (
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
 
-// replace github.com/jfrog/jfrog-cli-security => github.com/jfrog/jfrog-cli-security dev
+replace github.com/jfrog/jfrog-cli-security => github.com/jfrog/jfrog-cli-security v1.41.3-0.20261108164505-d19dab5de46c
 
 // replace github.com/jfrog/jfrog-cli-core/v2 => github.com/jfrog/jfrog-cli-core/v2 dev
 

go.sum

@@ -154,10 +154,10 @@ github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20261101122816-c0098229a376 h1:K
 github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20261101122816-c0098229a376/go.mod h1:94/aLloMSK6avu4umcJS3DJ6IuGM5K10PwZ6kDqgzSo=
 github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20261027135447-d76f4db4eedc h1:xrIYOKdHgIcYZEP9+bw14Ts6ZQyeSs2UGD6cQxhXV40=
 github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20261027135447-d76f4db4eedc/go.mod h1:dU4UKp2AB2MPsVd+v+o9a2/O3vVO2/Yt2dZ5ajqQUnI=
-github.com/jfrog/jfrog-cli-security v1.41.2 h1:yLGCrg8T54y2HatjXSSawMVU8c03+dv2Tl8Y9Gz2G54=
-github.com/jfrog/jfrog-cli-security v1.41.2/go.mod h1:2LD9S9gqEGSvxUhVC+/DLIPzXFIg6jdCaw5pMdfnS7Y=
-github.com/jfrog/jfrog-client-go v1.55.1-0.20261029150622-a2075f5e551a h1:YcDqBspQfxmIgjKY1S6XWzHiAoYL2e6pP4Yy0s09Ky0=
-github.com/jfrog/jfrog-client-go v1.55.1-0.20261029150622-a2075f5e551a/go.mod h1:+WGudVz1kZofy4hfEidGdTXqF/E51IC65z4yTtt0TwE=
+github.com/jfrog/jfrog-cli-security v1.41.3-0.20261108164505-d19dab5de46c h1:eZnlUZ+NIDrSqHIOkTWMzES9EPhlAkCp8S0E2zMYS7s=
+github.com/jfrog/jfrog-cli-security v1.41.3-0.20261108164505-d19dab5de46c/go.mod h1:MhtXEKVzi9eoOsZr6dx4hyNhvhvdfXhDp5N9rie3mxU=
+github.com/jfrog/jfrog-client-go v1.55.1-0.20261102081622-45c51cfca4f7 h1:gd1jzPoUxEsfL0N2qebHyemEHKqvob6d9Q8yOl0D5zE=
+github.com/jfrog/jfrog-client-go v1.55.1-0.20261102081622-45c51cfca4f7/go.mod h1:+WGudVz1kZofy4hfEidGdTXqF/E51IC65z4yTtt0TwE=
 github.com/jhump/protoreflect v1.15.1 h1:HUMERORf3I3ZdX05WaQ6MIpd/NJ434hTp5YiKgfCL6c=
 github.com/jhump/protoreflect v1.15.1/go.mod h1:jD/2GMKKE6OqX8qTjhADU1e6DShO+gavG9e0Q693nKo=
 github.com/kevinburke/ssh_config v1.6.0 h1:J1FBfmuVosPHf5GRdltRLhPJtJpTlMdKTBjRgTaQBFY=

testdata/scanpullrequest/expected_response_multi_dir.md

@@ -11,11 +11,11 @@
 
 
 ## 📗 Scan Summary
-- Frogbot scanned for vulnerabilities and found 12 issues
+- Frogbot scanned for vulnerabilities and found 11 issues
 
 | Scan Category                | Status                  | Security Issues                  |
 | --------------------- | :-----------------------------------: | ----------------------------------- |
-| **Software Composition Analysis** | ✅ Done | <details><summary><b>12 Issues Found</b></summary><img src="https://raw.githubusercontent.com/jfrog/frogbot/master/resources/v2/smallHigh.svg" alt=""/> 10 High<br><img src="https://raw.githubusercontent.com/jfrog/frogbot/master/resources/v2/smallMedium.svg" alt=""/> 2 Medium<br></details> |
+| **Software Composition Analysis** | ✅ Done | <details><summary><b>11 Issues Found</b></summary><img src="https://raw.githubusercontent.com/jfrog/frogbot/master/resources/v2/smallHigh.svg" alt=""/> 10 High<br><img src="https://raw.githubusercontent.com/jfrog/frogbot/master/resources/v2/smallMedium.svg" alt=""/> 1 Medium<br></details> |
 | **Contextual Analysis** | ✅ Done | - |
 | **Static Application Security Testing (SAST)** | ✅ Done | Not Found |
 | **Secrets** | ✅ Done | - |
@@ -26,7 +26,6 @@
 
 | Severity                | ID                  | Contextual Analysis                  | Dependency Path                  |
 | :---------------------: | :-----------------------------------: | :-----------------------------------: | ----------------------------------- |
-| ![medium](https://raw.githubusercontent.com/jfrog/frogbot/master/resources/v2/applicableMediumSeverity.png)<br>  Medium | CVE-2026-118764 | Not Covered | <details><summary><b>1 Direct</b></summary>minimatch:3.0.4<br></details> |
 | ![medium](https://raw.githubusercontent.com/jfrog/frogbot/master/resources/v2/applicableMediumSeverity.png)<br>  Medium | CVE-2026-102277 | Not Covered | <details><summary><b>1 Transitive</b></summary>brace-expansion:1.1.12<br></details> |
 | ![high (not applicable)](https://raw.githubusercontent.com/jfrog/frogbot/master/resources/v2/notApplicableHigh.png)<br>    High | CVE-2026-69152 | Not Applicable | <details><summary><b>1 Transitive</b></summary>brace-expansion:1.1.12<br></details> |
 | ![high (not applicable)](https://raw.githubusercontent.com/jfrog/frogbot/master/resources/v2/notApplicableHigh.png)<br>    High | CVE-2026-33750 | Not Applicable | <details><summary><b>1 Transitive</b></summary>brace-expansion:1.1.12<br></details> |
@@ -42,45 +41,6 @@
 ### 🔖 Details
 
 
-<details><summary><b>[ CVE-2026-118764 ] minimatch 3.0.4</b></summary>
-
-### Vulnerability Details
-|                 |                   |
-| --------------------- | :-----------------------------------: |
-| **Contextual Analysis:** | Not Covered |
-| **CVSS V3:** | - |
-| **Dependency Path:** | <details><summary><b>minimatch: 3.0.4 (Direct)</b></summary>Fix Version: 11.0.1<br></details> |
-
-minimatch 10.2.6 contains an attacker-controlled pattern amplification in firstPhasePreProcess() when optimizationLevel >= 2.
-
-researcher: Reid Downing (b1nv0id)
-files: 
-
-- src/index.ts: 690-770
-- src/index.ts: 780-796
-
-issue:
-input-controlled growth of globParts during first-phase preprocessing, followed by quadratic second-phase processing.
-
-the **/../ transformation clones a globparts entry and appends the clone to the same globparts array:
-```
-parts.splice(gs, 1)
-const other = parts.slice(0)
-other[gs] = '**'
-globParts.push(other)
-```
-this occurs inside a do...while (didSomething) fixpoint loop, allowing generated entries to be processed again.
-
-the expanded globparts array is subsequently processed by secondPhasePreProcess(), which performs pairwise comparisons:
-```
-for (let i = 0; i < globParts.length - 1; i++) {
-  for (let j = i + 1; j < globParts.length; j++) {
-    this.partsMatch(...)
-  }
-}
-```
-an attacker who can supply a glob pattern can therefore cause additional pattern entries to be generated during preprocessing, followed by quadratic pairwise processing, resulting in excessive cpu and memory consumption.<br></details>
-
 <details><summary><b>[ CVE-2026-102277 ] brace-expansion 1.1.12</b></summary>
 
 ### Vulnerability Details

utils/getconfiguration.go

@@ -181,10 +181,15 @@ func GetFrogbotDetails(commandName string) (frogbotDetails *FrogbotDetails, err
 
 func createFrogbotDetails(xrayVersion string, xscVersion string, repository Repository, client vcsclient.VcsClient, jfrogServer *coreconfig.ServerDetails) *FrogbotDetails {
 	frogbotDetails := FrogbotDetails{XrayVersion: xrayVersion, XscVersion: xscVersion, Repository: repository, GitClient: client, ServerDetails: jfrogServer}
-	frogbotDetails.ReleasesRepo = os.Getenv(jfrogReleasesRepoEnv)
-	if frogbotDetails.ReleasesRepo == "" {
+	if repository.ConfigProfile != nil {
 		frogbotDetails.ReleasesRepo = repository.GeneralConfig.ScannersDownloadPath
 	}
+	envReleasesRepo := os.Getenv(jfrogReleasesRepoEnv)
+	if frogbotDetails.ReleasesRepo == "" {
+		frogbotDetails.ReleasesRepo = envReleasesRepo
+	} else if envReleasesRepo != "" && envReleasesRepo != frogbotDetails.ReleasesRepo {
+		log.Info(fmt.Sprintf("Both the Config Profile and the '%s' environment variable define a releases repository. Using the Config Profile value '%s' and ignoring '%s'", jfrogReleasesRepoEnv, frogbotDetails.ReleasesRepo, envReleasesRepo))
+	}
 	return &frogbotDetails
 }
 

utils/getconfiguration_test.go

@@ -546,3 +546,46 @@ func createMockVcsClient(t *testing.T, repoOwner, repoName string, withError boo
 	}
 	return mockVcsClient
 }
+
+func TestCreateFrogbotDetailsReleasesRepo(t *testing.T) {
+	defer func() {
+		assert.NoError(t, SanitizeEnv())
+	}()
+	testCases := []struct {
+		name         string
+		profile      *services.ConfigProfile
+		envValue     string
+		expectedRepo string
+	}{
+		{
+			name:         "Profile only",
+			profile:      &services.ConfigProfile{GeneralConfig: services.GeneralConfig{ScannersDownloadPath: "profile-repo"}},
+			expectedRepo: "profile-repo",
+		},
+		{
+			name:         "Env var only",
+			profile:      &services.ConfigProfile{},
+			envValue:     "env-repo",
+			expectedRepo: "env-repo",
+		},
+		{
+			name:         "Both, profile takes priority",
+			profile:      &services.ConfigProfile{GeneralConfig: services.GeneralConfig{ScannersDownloadPath: "profile-repo"}},
+			envValue:     "env-repo",
+			expectedRepo: "profile-repo",
+		},
+		{
+			name:         "Neither",
+			profile:      &services.ConfigProfile{},
+			expectedRepo: "",
+		},
+	}
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			SetEnvAndAssert(t, map[string]string{jfrogReleasesRepoEnv: testCase.envValue})
+			repository := Repository{Params: Params{ConfigProfile: testCase.profile}}
+			frogbotDetails := createFrogbotDetails("", "", repository, nil, nil)
+			assert.Equal(t, testCase.expectedRepo, frogbotDetails.ReleasesRepo)
+		})
+	}
+}