fix(deps): pin click/cryptography/pip past 2026-08 advisories (CI red on #203) - #207
Draft
Sbussiso wants to merge 2 commits into
Draft
fix(deps): pin click/cryptography/pip past 2026-08 advisories (CI red on #203)#207Sbussiso wants to merge 2 commits into
Sbussiso wants to merge 2 commits into
Conversation
Bumps [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) from 2.0.51 to 2.0.52. - [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases) - [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst) - [Commits](https://github.com/sqlalchemy/sqlalchemy/commits) --- updated-dependencies: - dependency-name: sqlalchemy dependency-version: 2.0.52 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
The Test & Deploy pip-audit --strict gate went red on 5 known vulnerabilities in 3 transitive deps: click 8.3.1 PYSEC-2026-2132 (fix 8.3.3) cryptography 48.0.1 PYSEC-2026-3552 (fix 50.0.0) cryptography 48.0.1 PYSEC-2026-3553 (fix 49.0.0) cryptography 48.0.1 PYSEC-2026-3554 (fix 49.0.0) pip 26.1.2 PYSEC-2026-3721 (fix 26.2) All three are transitive (click via uvicorn, cryptography via clerk-backend-api/authlib, pip via pip-audit itself) and landed in the PyPA advisory DB after the last green deploy — no code changed. This follows the existing pattern in constraint-dependencies: bump the floor so uv resolves past the vulnerable version, with a comment citing the advisory and the date, to be removed once a direct dep's own pin clears. click 8.3.1 -> 8.4.2 cryptography 48.0.1 -> 50.0.0 pip 26.1.2 -> 26.2.1 Verified locally against the exact failing gate plus the other backend gates: pip-audit --strict clean, ruff clean, 699 tests pass. Refs CI run 32779491429 (branch dependabot/uv/backend/sqlalchemy-2.0.52).
This was referenced Aug 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
CI run 32779491429 (the
Test & Deploycheck on dependabot PR #203) failed at the Dependency scan (pip-audit) step —uv run pip-audit --strictreported 5 known vulnerabilities in 3 transitive packages:These advisories landed in the PyPA Advisory DB after the last green deploy — no application code changed. All three are transitive:
uvicornclerk-backend-api/authlibpip-audititself (dev/CI surface only; not shipped in the app image)What
Follows the existing
constraint-dependenciespattern inbackend/pyproject.toml: bump the version floor souvresolves past the vulnerable version, with a comment citing the advisory + date, to be removed once a direct dep's own pin clears.click8.3.1 → 8.4.2 (new constraint, was unconstrained)cryptography48.0.1 → 50.0.0pip26.1.2 → 26.2.1Lock regenerated with
uv lock.Verification (local, same gates as
deploy.yml)Notes
dependabot/uv/backend/sqlalchemy-2.0.52was merged as build(deps): bump sqlalchemy from 2.0.51 to 2.0.52 in /backend #203 seconds after the failure was recorded (squash-mergea0d637c), so the vulnerable lock is now onmaster— this PR targetsmaster.fbba124.