From 31c4988c0c55b80ffde910217572024693f3b916 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 10 Aug 2026 21:28:59 +0000 Subject: [PATCH 1/2] build(deps): bump redis from 7.4.0 to 8.1.0 in /backend Bumps [redis](https://github.com/redis/redis-py) from 7.4.0 to 8.1.0. - [Release notes](https://github.com/redis/redis-py/releases) - [Changelog](https://github.com/redis/redis-py/blob/master/CHANGES) - [Commits](https://github.com/redis/redis-py/compare/v7.4.0...v8.1.0) --- updated-dependencies: - dependency-name: redis dependency-version: 8.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- backend/pyproject.toml | 2 +- backend/uv.lock | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/backend/pyproject.toml b/backend/pyproject.toml index 26badf5..9474026 100644 --- a/backend/pyproject.toml +++ b/backend/pyproject.toml @@ -24,7 +24,7 @@ dependencies = [ "svix>=1.99.1", "clerk-backend-api>=5.0.6", "slowapi>=0.1.10", - "redis>=5.0.0", + "redis>=8.1.0", "websockets>=16.1.1", "fastmcp>=3.4.6", "sentry-sdk[fastapi]>=2.66.1", diff --git a/backend/uv.lock b/backend/uv.lock index ff6a496..51374fb 100644 --- a/backend/uv.lock +++ b/backend/uv.lock @@ -1479,11 +1479,11 @@ wheels = [ [[package]] name = "redis" -version = "7.4.0" +version = "8.1.0" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/7b/7f/3759b1d0d72b7c92f0d70ffd9dc962b7b7b5ee74e135f9d7d8ab06b8a318/redis-7.4.0.tar.gz", hash = "sha256:64a6ea7bf567ad43c964d2c30d82853f8df927c5c9017766c55a1d1ed95d18ad", size = 4943913, upload-time = "2026-03-24T09:14:37.53Z" } +sdist = { url = "https://files.pythonhosted.org/packages/a8/99/604f0b666d4c616d891cf77ebb9db6bb21601344c051aebf1b72b9ff915f/redis-8.1.0.tar.gz", hash = "sha256:6e1a19beef9225c83efd689c7e6b7da2d5215b1f42cd13b7fc3714d0a09c7b25", size = 5254356, upload-time = "2026-07-30T08:51:00.269Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/74/3a/95deec7db1eb53979973ebd156f3369a72732208d1391cd2e5d127062a32/redis-7.4.0-py3-none-any.whl", hash = "sha256:a9c74a5c893a5ef8455a5adb793a31bb70feb821c86eccb62eebef5a19c429ec", size = 409772, upload-time = "2026-03-24T09:14:35.968Z" }, + { url = "https://files.pythonhosted.org/packages/66/9d/c5731f6e3608663d4d3656fd8d3aecee8b509c3082818f5a13eae925baea/redis-8.1.0-py3-none-any.whl", hash = "sha256:a4fe1aac3d3b3cc791d4b3d5931c5a956045dc951ee74d1c913ee3ac4d2ee9fb", size = 560618, upload-time = "2026-07-30T08:50:58.497Z" }, ] [[package]] @@ -1722,7 +1722,7 @@ requires-dist = [ { name = "pytest-asyncio", marker = "extra == 'dev'", specifier = ">=1.4.0" }, { name = "python-dotenv", specifier = ">=1.0.0" }, { name = "python-multipart", specifier = ">=0.0.31" }, - { name = "redis", specifier = ">=5.0.0" }, + { name = "redis", specifier = ">=8.1.0" }, { name = "resend", specifier = ">=2.35.0" }, { name = "ruff", marker = "extra == 'dev'", specifier = ">=0.16.2" }, { name = "sentry-sdk", extras = ["fastapi"], specifier = ">=2.66.1" }, From 87983db6912e93d706061da75347b2b6846f9cbf Mon Sep 17 00:00:00 2001 From: Sbussiso Date: Mon, 10 Aug 2026 21:35:50 +0000 Subject: [PATCH 2/2] fix(ci): clear pip-audit --strict for redis 8.1.0 bump Run #550 on dependabot/uv/backend/redis-8.1.0 failed the 'Backend tests > Dependency scan (pip-audit)' step: Found 4 known vulnerabilities in 2 packages click 8.3.1 PYSEC-2026-2132 fix 8.3.3 cryptography 48.0.1 PYSEC-2026-3552 fix 50.0.0 cryptography 48.0.1 PYSEC-2026-3553 fix 49.0.0 cryptography 48.0.1 PYSEC-2026-3554 fix 49.0.0 Both are transitive deps, not pulled in by the redis bump itself; they surfaced because the strict advisory scan runs on every backend CI job. click (PYSEC-2026-2132): command injection in click.edit() (the interactive $EDITOR helper), fixed in 8.3.3. Transitive via uvicorn and fastmcp-slim/mcp. We never call click.edit() from a server process, but --strict flags it regardless. Fix is installable, so add a constraint pin "click>=8.3.3" (uv resolves 8.4.2). cryptography (PYSEC-2026-3552/3553/3554): Bleichenbacher oracle in pkcs7_decrypt_*, exponential cert path-building DoS, and wildcard DNS SAN escape from permittedSubtrees. Fixes land in 49.0.0 / 50.0.0, but clerk-backend-api 6.0.1 (latest) declares cryptography<49.0.0,>=45.0.0, so the fixed versions are NOT installable while we depend on clerk. None of the vulnerable paths are reachable from our code (we use PyJWT + clerk for JWT/JWS, not cryptography's pkcs7/X.509 paths). Suppress with --ignore-vuln in both deploy.yml and weekly-deps-refresh.yml, with comments pointing at the upstream blocker and the revisit condition (clerk shipping a release allowing cryptography>=50.0.0). Verified locally from a clean venv: uv lock --check OK uv sync --extra dev --locked click 8.3.1 -> 8.4.2 uv run pip-audit --strict --ignore-vuln x3 No vulns, 3 ignored uv run ruff check All checks passed uv run pytest -q 699 passed --- .github/workflows/deploy.yml | 18 +++++++++++++- .github/workflows/weekly-deps-refresh.yml | 10 +++++++- backend/pyproject.toml | 29 ++++++++++++++++++++++- backend/uv.lock | 7 +++--- 4 files changed, 58 insertions(+), 6 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index d5127c7..05168cf 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -53,9 +53,25 @@ jobs: # the advisory DB counts. When a CVE shows up with no fix # yet, add ``--ignore-vuln `` here with a comment # citing the upstream issue and the date we plan to revisit. + # + # 2026-08-10 -- cryptography 48.0.1 carries three advisories + # (PYSEC-2026-3552/3553/3554) whose fixes (49.0.0 / 50.0.0) + # are blocked upstream: clerk-backend-api 6.0.1 (latest) + # declares cryptography<49.0.0,>=45.0.0, so the fixed versions + # cannot be installed while we depend on clerk. None of the + # vulnerable paths are reachable from our code (no + # pkcs7_decrypt_*, no X.509 verification of attacker-controlled + # cert chains -- we use PyJWT + clerk for JWT/JWS). Suppress + # until clerk-backend-api ships a release allowing + # cryptography>=50.0.0. See backend/pyproject.toml + # (constraint-dependencies) for the full write-up. - name: Dependency scan (pip-audit) working-directory: backend - run: uv run pip-audit --strict + run: | + uv run pip-audit --strict \ + --ignore-vuln PYSEC-2026-3552 \ + --ignore-vuln PYSEC-2026-3553 \ + --ignore-vuln PYSEC-2026-3554 - name: Run tests working-directory: backend diff --git a/.github/workflows/weekly-deps-refresh.yml b/.github/workflows/weekly-deps-refresh.yml index 051be58..989c351 100644 --- a/.github/workflows/weekly-deps-refresh.yml +++ b/.github/workflows/weekly-deps-refresh.yml @@ -62,7 +62,15 @@ jobs: run: uv run ruff check - name: Backend dependency scan (pip-audit --strict) working-directory: backend - run: uv run pip-audit --strict + # ignore-vuln parity with deploy.yml: cryptography 48.0.1 + # advisories (PYSEC-2026-3552/3553/3554) are blocked upstream + # by clerk-backend-api's <49.0.0 cap. See deploy.yml for the + # full write-up. + run: | + uv run pip-audit --strict \ + --ignore-vuln PYSEC-2026-3552 \ + --ignore-vuln PYSEC-2026-3553 \ + --ignore-vuln PYSEC-2026-3554 - name: Backend tests working-directory: backend run: uv run pytest -q diff --git a/backend/pyproject.toml b/backend/pyproject.toml index 9474026..34d2f79 100644 --- a/backend/pyproject.toml +++ b/backend/pyproject.toml @@ -161,6 +161,25 @@ constraint-dependencies = [ # clerk-backend-api / authlib. Remove once a direct dep's own pin # clears cryptography 48.0.1. "cryptography>=48.0.1", + # cryptography 48.0.1 carries three further advisories whose fixes + # are NOT installable yet: + # - PYSEC-2026-3552 (Bleichenbacher oracle in pkcs7_decrypt_*, + # fixed 50.0.0) + # - PYSEC-2026-3553 (exponential cert path-building DoS, fixed + # 49.0.0) + # - PYSEC-2026-3554 (wildcard DNS SAN escape from permittedSubtrees, + # fixed 49.0.0) + # None of the vulnerable paths are reachable from our code (we use + # PyJWT + clerk-backend-api for JWT/JWS, never cryptography's + # pkcs7_decrypt_* or X.509 verification of attacker-controlled + # chains), and clerk-backend-api 6.0.1 (latest) declares + # cryptography<49.0.0,>=45.0.0 -- so the highest version uv can + # resolve is still 48.0.1. Until clerk ships a release allowing + # cryptography>=50.0.0, these three IDs are suppressed in the + # pip-audit step via --ignore-vuln (see .github/workflows/deploy.yml + # and weekly-deps-refresh.yml). Revisit when clerk-backend-api + # bumps its cryptography upper bound. + # # joserfc: CVE-2026-48990 (fixed in 1.6.7). Transitive via # clerk-backend-api. Remove once clerk's own pin clears 1.6.7. "joserfc>=1.6.7", @@ -170,4 +189,12 @@ constraint-dependencies = [ # pydantic-settings: GHSA-4xgf-cpjx-pc3j (fixed in 2.14.2). Transitive # via fastmcp. Remove once fastmcp's own pin clears 2.14.2. "pydantic-settings>=2.14.2", -] \ No newline at end of file + # click: PYSEC-2026-2132 (command injection in click.edit() -- an + # unprivileged account can pass arbitrary OS commands through the + # $EDITOR helper; affects <=8.3.2). Fixed in 8.3.3. Transitive via + # uvicorn (CLI entrypoint) and fastmcp-slim / mcp. We never call + # click.edit() (interactive $EDITOR helper, unusable from a + # server process) but pip-audit --strict flags it. Remove once + # uvicorn or mcp's own pin clears click 8.3.3. + "click>=8.3.3", +] diff --git a/backend/uv.lock b/backend/uv.lock index 51374fb..ff3f3ba 100644 --- a/backend/uv.lock +++ b/backend/uv.lock @@ -11,6 +11,7 @@ resolution-markers = [ [manifest] constraints = [ { name = "authlib", specifier = ">=1.7.1" }, + { name = "click", specifier = ">=8.3.3" }, { name = "cryptography", specifier = ">=48.0.1" }, { name = "idna", specifier = ">=3.15" }, { name = "joserfc", specifier = ">=1.6.7" }, @@ -309,14 +310,14 @@ wheels = [ [[package]] name = "click" -version = "8.3.1" +version = "8.4.2" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "colorama", marker = "sys_platform == 'win32'" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/3d/fa/656b739db8587d7b5dfa22e22ed02566950fbfbcdc20311993483657a5c0/click-8.3.1.tar.gz", hash = "sha256:12ff4785d337a1bb490bb7e9c2b1ee5da3112e94a8622f26a6c77f5d2fc6842a", size = 295065, upload-time = "2025-11-15T20:45:42.706Z" } +sdist = { url = "https://files.pythonhosted.org/packages/76/d4/81420972a676e8ffea40450d8c8c92943e7218a78fe9b64359836cc9876b/click-8.4.2.tar.gz", hash = "sha256:9a6cea6e60b17ebe0a44c5cc636d94f09bd66142c1cd7d8b4cd731c4917a15f6", size = 338000, upload-time = "2026-06-24T17:45:15.148Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/98/78/01c019cdb5d6498122777c1a43056ebb3ebfeef2076d9d026bfe15583b2b/click-8.3.1-py3-none-any.whl", hash = "sha256:981153a64e25f12d547d3426c367a4857371575ee7ad18df2a6183ab0545b2a6", size = 108274, upload-time = "2025-11-15T20:45:41.139Z" }, + { url = "https://files.pythonhosted.org/packages/fb/e2/79c688af8b210d232694e31e59da9f6ec747bae31c3f5946e4e9b98860d5/click-8.4.2-py3-none-any.whl", hash = "sha256:e6f9f66136c816745b9d65817da91d61d957fb16e02e4dcd0552553c5a197b76", size = 119243, upload-time = "2026-06-24T17:45:13.73Z" }, ] [[package]]