fix(deps): unblock CI — force click>=8.3.3 & cryptography>=50.0.0 (pip-audit --strict) - #195
Draft
Sbussiso wants to merge 1 commit into
Draft
fix(deps): unblock CI — force click>=8.3.3 & cryptography>=50.0.0 (pip-audit --strict)#195Sbussiso wants to merge 1 commit into
Sbussiso wants to merge 1 commit into
Conversation
…-deps
CI run #578 (workflow Test and Deploy) on this branch failed the
uv run pip-audit --strict step with 4 known vulnerabilities:
click 8.3.1 PYSEC-2026-2132 (fix: 8.3.3)
cryptography 48.0.1 PYSEC-2026-3552 (fix: 50.0.0)
cryptography 48.0.1 PYSEC-2026-3553 (fix: 49.0.0)
cryptography 48.0.1 PYSEC-2026-3554 (fix: 49.0.0)
None are related to the redis 7.4.0 to 8.1.0 bump this PR carries;
they are transitive deps (click via uvicorn/resend/pip-audit,
cryptography via clerk-backend-api/authlib) whose advisories landed
during a quiet window and turned the strict scan red.
Fix follows the existing constraint-dependencies pattern in this
pyproject.toml (same mechanism already pins authlib, urllib3, idna,
starlette, pip, joserfc, msgpack, pydantic-settings):
- bump the cryptography constraint 48.0.1 to 50.0.0 (covers all 3
cryptography CVEs: 3552 fixed in 50.0.0; 3553/3554 fixed in 49.0.0)
- add a new click>=8.3.3 constraint (PYSEC-2026-2132)
Side effect: forcing cryptography>=50.0.0 transitively bumps
clerk-backend-api 6.0.1 to 7.0.0, because clerk 6.0.1 caps
cryptography at <49.0.0 (incompatible with the >=50.0.0 floor). This
is unavoidable: verified by attempting to hold clerk<7, which makes
the resolution unsatisfiable. The clerk 7.0.0 major bump is limited
to dependency metadata; the full backend test suite (699 tests)
passes against it.
Verified locally:
- uv lock resolves cleanly (121 packages, only click/clerk/
cryptography change versions; no packages added or dropped)
- uv run --frozen pip-audit --strict: No known vulnerabilities
- uv run --frozen pytest -q: 699 passed, 0 failed
Remove the click + cryptography constraints once a direct dep own pin
clears click 8.3.3 / cryptography 50.0.0 (clerk 7.0.0 already allows
cryptography 50.x, so once clerk floor moves past 7 this constraint
becomes redundant).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Unblocks the failing
pip-audit --strictstep in CI run #578 ondependabot/uv/backend/redis-8.1.0.The scan reported 4 known vulnerabilities, none related to the redis 7.4.0 → 8.1.0 bump this PR carries — they are transitive deps whose advisories landed during a quiet window:
Fix
Follows the existing
constraint-dependenciespattern already inbackend/pyproject.toml(same mechanism pinsauthlib,urllib3,idna,starlette,pip,joserfc,msgpack,pydantic-settings):cryptographyconstraint48.0.1 → 50.0.0(covers all 3 cryptography CVEs)click>=8.3.3constraint (PYSEC-2026-2132)Forcing
cryptography>=50.0.0transitively bumpsclerk-backend-apifrom6.0.1to7.0.0. This is unavoidable: clerk 6.0.1 capscryptography<49.0.0, which is incompatible with the>=50.0.0floor needed to clear the CVEs. Verified by attempting to holdclerk<7— uv reports the resolution as unsatisfiable.The clerk 7.0.0 major bump is limited to dependency metadata; no application code uses APIs removed in 7.0.0 (verified by the full test suite below). Flagging it explicitly because it is a major version bump of the auth library, not just a security pin.
Verification (local, on this branch)
Lock diff is exactly 3 version bumps (click, clerk, cryptography) — no packages added or dropped.
Cleanup note
Remove the
click+cryptographyconstraints once a direct dep's own pin clearsclick 8.3.3/cryptography 50.0.0. clerk 7.0.0 already permitscryptography 50.x, so once clerk's floor moves past 7 the cryptography constraint becomes redundant.— Hermes coder CI triage (run 32071729680)