build(deps): fix pip-audit --strict failures (click, cryptography, pip) - #197
Draft
Sbussiso wants to merge 1 commit into
Draft
build(deps): fix pip-audit --strict failures (click, cryptography, pip)#197Sbussiso wants to merge 1 commit into
Sbussiso wants to merge 1 commit into
Conversation
CI run #580 (32700796646) failed the `pip-audit --strict` step with 5
known vulnerabilities in 3 packages:
click 8.3.1 PYSEC-2026-2132 -> fix 8.3.3
cryptography 48.0.1 PYSEC-2026-3552 -> fix 50.0.0
cryptography 48.0.1 PYSEC-2026-3553 -> fix 49.0.0
cryptography 48.0.1 PYSEC-2026-3554 -> fix 49.0.0
pip 26.1.2 PYSEC-2026-3721 -> fix 26.2
Bump the transitive constraint-dependencies floors that had become
vulnerable, and add a new `click>=8.3.3` constraint:
pip >=26.1.2 -> >=26.2
click (new) >=8.3.3
cryptography >=48.0.1 -> >=50.0.0
The cryptography>=50.0.0 floor forces clerk-backend-api 6.0.1 -> 7.0.0,
because clerk 6.0.1 caps cryptography at <49.0.0 and the CVE fixes
require >=49.0.0 (3553/3554) / >=50.0.0 (3552). clerk 7.0.0 widens the
range to <51.0.0,>=45.0.0. The backend only uses clerk's
organizations.list / .get_billing_subscription / .update endpoints, all
699 tests pass against clerk 7.0.0, and `uv run pip-audit --strict` is
now clean ("No known vulnerabilities found").
Verified locally:
- uv lock resolves cleanly (121 packages)
- uv run pytest -q -> 699 passed
- uv run pip-audit --strict -> No known vulnerabilities found
Sbussiso
referenced
this pull request
Aug 24, 2026
Bumps [@testing-library/jest-dom](https://github.com/testing-library/jest-dom) from 6.9.1 to 7.0.1. - [Release notes](https://github.com/testing-library/jest-dom/releases) - [Changelog](https://github.com/testing-library/jest-dom/blob/main/CHANGELOG.md) - [Commits](testing-library/jest-dom@v6.9.1...v7.0.1) --- updated-dependencies: - dependency-name: "@testing-library/jest-dom" dependency-version: 7.0.1 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the
pip-audit --strictfailure in CI run #580 (branchci-fix/32700481827).The dependency scan found 5 known vulnerabilities in 3 packages:
Changes
Bumps the transitive
constraint-dependenciesfloors inbackend/pyproject.tomlthat had themselves become vulnerable, and adds a newclickconstraint:pip:>=26.1.2→>=26.2click: (new)>=8.3.3cryptography:>=48.0.1→>=50.0.0Side effect: clerk-backend-api 6.0.1 → 7.0.0
The
cryptography>=50.0.0floor forcesclerk-backend-apifrom 6.0.1 to 7.0.0, because clerk 6.0.1 caps cryptography at<49.0.0and the CVE fixes require>=49.0.0(3553/3554) and>=50.0.0(3552). clerk 7.0.0 widens the range to<51.0.0,>=45.0.0.The backend only uses clerk's
organizations.list/.get_billing_subscription/.updateendpoints — a narrow, stable surface. This is a major version bump of a direct auth dependency, so it's the part most worth a human review; that's why this PR is a draft.Verification (local, sandbox)
uv lock→ resolves cleanly (121 packages)uv run pytest -q→ 699 passeduv run pip-audit --strict→ No known vulnerabilities foundResolved versions in the new lock:
Hermes coder CI triage — run 32700796646