Disable vulnerable arXiv MCP container

[Copilot]

The pinned mcp/arxiv-mcp-server image contains 131 Critical/High vulnerabilities and extensive license-policy violations.

• Disable the integration

  • Remove the arXiv MCP server definition.
  • Exclude it from Scout and MCP Inspector until a patched image is available.

• Remove vulnerable artifacts

  • Delete the image digest from canonical and embedded pin manifests.
  • Regenerate affected workflow lock files.

• Fixes [container-image-scan] Container findings for mcp/arxiv-mcp-server #51713

---

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 11.8 AIC · ⌖ 5.41 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

[pelikhan]

@copilot resolve the merge conflicts on this branch.

[Copilot]

Pull request overview

Disables the vulnerable arXiv MCP integration and removes its pinned container artifacts.

Changes:

• Removes arXiv MCP imports from Scout and MCP Inspector.
• Replaces the server definition with a security notice.
• Removes the image digest from manifests and regenerated locks.

Show a summary per file

File	Description
.github/aw/actions-lock.json	Removes the vulnerable image pin.
.github/workflows/mcp-inspector.lock.yml	Regenerates Inspector without arXiv.
.github/workflows/mcp-inspector.md	Excludes the arXiv integration.
.github/workflows/scout.lock.yml	Regenerates Scout without arXiv.
.github/workflows/scout.md	Excludes the arXiv integration.
.github/workflows/shared/mcp/arxiv.md	Disables the server definition.
pkg/actionpins/data/action_pins.json	Removes the embedded image pin.
pkg/workflow/data/action_pins.json	Removes the workflow image pin.

Review details

Tip

Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 8/8 changed files
• Comments generated: 0
• Review effort level: Balanced

[Copilot]

@copilot resolve the merge conflicts on this branch.

Resolved. I merged origin/main, fixed the conflicts, and regenerated the affected lock files in commits a5b113c and e5ba5e3.

[gh-aw-bot]

@copilot PR sous-chef triage: this branch is conflicting. Please run make merge-main to resolve conflicts, then run the pr-finisher skill before handing this back to maintainers.

No failed checks were listed in the compact candidate snapshot.
Run details: https://github.com/github/gh-aw/actions/runs/31386523734

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 15.8 AIC · ⌖ 7.79 AIC · ⊞ 6.1K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot PR sous-chef triage: this branch is conflicting. Please run make merge-main to resolve conflicts, then run the pr-finisher skill before handing this back to maintainers.

No failed checks...

Ran make merge-main and completed PR-finisher triage for this branch. No new conflicts were found and no additional code changes were required; current head remains e5ba5e3.

[github-actions]

Triage: Disable vulnerable arXiv MCP container

• Category: bug (security) | Risk: medium | Score: 76/100 (impact 35, urgency 26, quality 15)
• Recommended action: fast_track (batch: security-container-mitigation)
• Notes: Removes container with 131 critical/high vulns + license violations. Small diff (10 files), copilot check passed. High urgency due to severity.

Generated by 🔧 PR Triage Agent · auto · 49.6 AIC · ⌖ 2.51 AIC · ⊞ 7.8K · ◷

[gh-aw-bot]

@copilot PR sous-chef triage: please refresh the current maintainer-facing state on the latest head and run the pr-finisher skill before handing this back to maintainers.

No failed checks were listed in the compact candidate snapshot.
Branch refresh was not requested because the branch is not currently conflicting and recent triage already reported no remaining conflicts.
Run details: https://github.com/github/gh-aw/actions/runs/31388253285

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 11.8 AIC · ⌖ 5.41 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot PR sous-chef triage: please refresh the current maintainer-facing state on the latest head and run the pr-finisher skill before handing this back to maintainers.

No failed checks were list...

Refreshed on latest head e5ba5e3 with PR-finisher triage.

• ✅ Reviews — no unresolved review threads.
• ✅ Checks (local) — make fmt, make lint, make test-unit, make test, make recompile, and make agent-report-progress passed in this run.
• ❓ Checks (CI) — current branch workflow snapshot showed no failed jobs in run 31388931984 (failed_jobs: 0), but CI on this head remains unverified/stale until a maintainer re-triggers.
• ✅ Mergeable — PR is open, not draft, and not conflicting (merge state is blocked by branch protections).

Actions taken: maintainer-facing triage refresh only; no file changes were needed (head remains e5ba5e3).
Hand-off: CI must be re-triggered by a maintainer (close/reopen PR, workflow_dispatch, or a maintainer push) before merge.
Still needed: required human approvals/check completion per branch protection.

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.86.2