fix(backend): clear pip-audit --strict on new cryptography/click advisories (CI #576) - #194
Draft
Sbussiso wants to merge 1 commit into
Draft
fix(backend): clear pip-audit --strict on new cryptography/click advisories (CI #576)#194Sbussiso wants to merge 1 commit into
Sbussiso wants to merge 1 commit into
Conversation
…sories (CI #576) The "Test and Deploy" run #576 (32071496012) failed at the "Dependency scan (pip-audit)" step on the dependabot/uv/backend/websockets-17.0.1 branch: Found 4 known vulnerabilities in 2 packages Name Version ID Fix Versions click 8.3.1 PYSEC-2026-2132 8.3.3 cryptography 48.0.1 PYSEC-2026-3552 50.0.0 cryptography 48.0.1 PYSEC-2026-3553 49.0.0 cryptography 48.0.1 PYSEC-2026-3554 49.0.0 New advisories landed in the PyPA Advisory DB (~2026-08) against two transitive deps the project doesn't pin directly (click via uvicorn, cryptography via clerk-backend-api / authlib). No code changed; the scan just started failing on unrelated Dependabot PRs. This is the same failure that already hit run #570 (setup-uv branch, PR #191) and run #577 (resend branch), and will keep recurring on every Dependabot PR until the constraint floor is raised. Fix: raise the transitive constraint floor in backend/pyproject.toml ([tool.uv] constraint-dependencies) and regenerate uv.lock: - click 8.3.1 -> 8.4.2 (new click>=8.3.3 constraint, PYSEC-2026-2132) - cryptography 48.0.1 -> 50.0.0 (cryptography>=50.0.0, clears all 3 advisories) Side effect: forcing cryptography>=50.0.0 also advances clerk-backend-api 6.0.1 -> 7.0.0 (major) because clerk 6.x caps cryptography<49.0.0, so the resolver is forced to clerk 7.0.0 which allows <51.0.0. The code only touches Clerk's stable auth surface (Clerk, authenticate_request, AuthenticateRequestOptions). This is the same major bump that the dedicated clerk-7.0.0 Dependabot PR (#185) is making, so merging this also supersedes that PR's lock change. Verified locally (sandbox, against this branch): - uv run ruff check -> All checks passed! - uv run pip-audit --strict -> No known vulnerabilities found - uv run pytest -q -> 699 passed Refs: actions/runs/32071496012 . Related: PR #191 (same fix, setup-uv branch). — Hermes coder CI triage (automated)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CI fix for run #576 — pip-audit --strict failure
The "Test & Deploy" run #576 (32071496012) failed at the Dependency scan (pip-audit) step, blocking this Dependabot PR (websockets 16.1.1 → 17.0.1):
Root cause
New advisories landed in the PyPA Advisory DB (~2026-08) against two transitive dependencies that the project doesn't pin directly:
click 8.3.1— pulled in viauvicorncryptography 48.0.1— pulled in viaclerk-backend-api/authlibNo code changed; the scan just started failing on unrelated PRs. This is the same failure that already hit run #570 (setup-uv branch → PR #191) and run #577 (resend branch), and will keep recurring on every Dependabot PR until the constraint floor is raised.
Fix
Raises the transitive constraint floor in
backend/pyproject.toml([tool.uv] constraint-dependencies) and regeneratesuv.lock:cryptography>=48.0.1→cryptography>=50.0.0(clears all 3 new advisories; 50.0.0 is the highest fix version)click>=8.3.3constraint (PYSEC-2026-2132)Forcing
cryptography>=50.0.0also advancesclerk-backend-api6.0.1 → 7.0.0 (a MAJOR bump). Clerk 6.x capscryptography<49.0.0, so the resolver is forced to clerk 7.0.0 (which allows<51.0.0). This is documented in the constraint comment. The code only touches Clerk's stable auth surface (Clerk,authenticate_request,AuthenticateRequestOptions), and the full suite passes against clerk 7.0.0 — but this deserves a look before merge since it touches the auth layer.This is the same major bump the dedicated clerk-7.0.0 Dependabot PR (#185) is making, so merging this supersedes that PR's lock change.
Verified locally (sandbox, against this branch)
uv run ruff check→ All checks passed!uv run pip-audit --strict→ No known vulnerabilities founduv run pytest -q→ 699 passedOnce merged into
dependabot/uv/backend/websockets-17.0.1, the pip-audit gate on this PR will go green.Related: PR #191 (same fix, setup-uv branch).
— Hermes coder CI triage (automated)