fix(deps): bump click + cryptography to clear pip-audit gate (run #577) - #192
Draft
Sbussiso wants to merge 1 commit into
Draft
fix(deps): bump click + cryptography to clear pip-audit gate (run #577)#192Sbussiso wants to merge 1 commit into
Sbussiso wants to merge 1 commit into
Conversation
CI run #577 (actions/runs/32071519810) on the dependabot/uv/backend/resend-2.36.0 branch failed at the `Dependency scan (pip-audit)` step: Found 4 known vulnerabilities in 2 packages Name Version ID Fix Versions click 8.3.1 PYSEC-2026-2132 8.3.3 cryptography 48.0.1 PYSEC-2026-3552 50.0.0 cryptography 48.0.1 PYSEC-2026-3553 49.0.0 cryptography 48.0.1 PYSEC-2026-3554 49.0.0 Both are transitive deps not pinned in the main dependencies list (click via uvicorn, cryptography via clerk-backend-api / authlib). Bump the constraint-dependencies floor: - click 8.3.1 -> 8.4.2 (>= 8.3.3) - cryptography 48.0.1 -> 50.0.0 (>= 50.0.0, clears all three advisories) `uv lock` also pulled clerk-backend-api 6.0.1 -> 7.0.0 transitively. Verified locally: $ uv run --extra dev pip-audit --strict No known vulnerabilities found $ uv run --extra dev pytest -q 699 passed Refs: actions/runs/32071519810 . PR #189
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Root cause — CI run #577 failure
Test & Deployrun #577 (actions/runs/32071519810) failed at theDependency scan (pip-audit)step on thedependabot/uv/backend/resend-2.36.0branch (commitd6c1e1b, PR #189):Both are transitive dependencies not pinned anywhere in the main
dependencieslist:clickviauvicorncryptographyviaclerk-backend-api/authlibThe resend bump in PR #189 refreshed the lockfile but left both pinned at vulnerable versions. Three new cryptography advisories (PYSEC-2026-3552/3553/3554) landed ~2026-08 and superseded the existing
cryptography>=48.0.1constraint.Fix
Bump the
constraint-dependenciesfloor inbackend/pyproject.toml:click8.3.1 → 8.4.2 (≥ 8.3.3, clears PYSEC-2026-2132)cryptography48.0.1 → 50.0.0 (≥ 50.0.0, clears all three PYSEC-2026-3552/3553/3554)uv lockpulledclerk-backend-api6.0.1 → 7.0.0 transitively (driven by the cryptography floor). Lockfile diff is version + hash lines only.Verification
Locally reproduced the failing gate and confirmed it now passes:
Note on base branch
The triggering branch
dependabot/uv/backend/resend-2.36.0was deleted when PR #189 merged, so this fix targetsmaster(where the vulnerableclick 8.3.1+cryptography 48.0.1now live). This also clears the default-branch vulnerabilities GitHub flags on push.Refs: #189 · run 32071519810