build(deps): fix pip-audit --strict failures (click, cryptography, pip) — CI run #589 - #211
Draft
Sbussiso wants to merge 1 commit into
Draft
build(deps): fix pip-audit --strict failures (click, cryptography, pip) — CI run #589#211Sbussiso wants to merge 1 commit into
Sbussiso wants to merge 1 commit into
Conversation
Run #32779432581 (Test & Deploy) failed on the "Dependency scan
(pip-audit)" step with 5 known vulnerabilities in 3 packages:
click 8.3.1 PYSEC-2026-2132 -> fix 8.3.3
cryptography 48.0.1 PYSEC-2026-3552 -> fix 50.0.0
cryptography 48.0.1 PYSEC-2026-3553 -> fix 49.0.0
cryptography 48.0.1 PYSEC-2026-3554 -> fix 49.0.0
pip 26.1.2 PYSEC-2026-3721 -> fix 26.2
All three are transitive; none are imported directly by app code.
click (via uvicorn) and pip (pulled in only by pip-audit itself;
not shipped in the app image) clear with simple constraint bumps.
cryptography is the non-trivial one: clerk-backend-api 6.x caps
cryptography <49.0.0, so PYSEC-2026-3552/3553/3554 cannot be cleared
without bumping clerk-backend-api 6 -> 7 (which widens the cap to
<51.0.0). The five clerk methods this app calls --
authenticate_request, organizations.{update,list,
get_billing_subscription}, organization_memberships.list -- all
exist unchanged on 7.0.0. Validated locally by reproducing the exact
CI sequence (uv sync --extra dev -> ruff check -> uv run pip-audit
--strict -> pytest):
- ruff: all checks passed
- pip-audit --strict: No known vulnerabilities found
- pytest: 699 passed
Sbussiso
referenced
this pull request
Aug 24, 2026
Bumps [happy-dom](https://github.com/capricorn86/happy-dom) from 20.11.2 to 20.11.6. - [Release notes](https://github.com/capricorn86/happy-dom/releases) - [Commits](capricorn86/happy-dom@v20.11.2...v20.11.6) --- updated-dependencies: - dependency-name: happy-dom dependency-version: 20.11.6 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Root cause
CI run #589 (actions/runs/32779707858) failed the
Backend tests / Dependency scan (pip-audit)step with 5 known vulnerabilities in 3 packages:The run was triggered by the frontend
happy-domDependabot PR (#205, now merged), but the failing job is an unrelated backend security scan. This is the repo's recurring "new advisory landed in the PyPA DB during a quiet week" pattern —pip-audit --strictflips red even though no app code changed.Fix
Bump the stale transitive
constraint-dependenciesfloors and add the newclickconstraint, following the repo's documented convention (each entry has a "Remove once X's own pin clears Y" comment):>=26.1.2>=26.2>=8.3.3>=48.0.1>=50.0.0The
cryptography>=50.0.0floor forces clerk-backend-api 6.0.1 → 7.0.0 because clerk 6.x capscryptography <49.0.0and the CVE fixes require>=49.0.0(3553/3554) />=50.0.0(3552). clerk 7.0.0 widens the cap to<51.0.0,>=45.0.0, so the direct dep is bumped from>=5.0.6to>=7.0.0.Verification (local, sandbox)
uv lock— resolved cleanly: click 8.4.2, cryptography 50.0.0, pip 26.2.1, clerk-backend-api 7.0.0uv run --extra dev pip-audit --strict— No known vulnerabilities found (exit 0)uv run --extra dev pytest -q— 699 passed in 11.86s (clerk-backend-api 7.0.0 is API-compatible: backend only uses clerk'sorganizations.list/.get_billing_subscription/.updateendpoints)Related
ci-fix/32700796646, fix(deps): pin click/cryptography/pip past 2026-08 advisories (CI red on #203) #207ci-fix/32779491429, and earlier ones). This branch is rebased on current master and drops the redundantsqlalchemybump that fix(deps): pin click/cryptography/pip past 2026-08 advisories (CI red on #203) #207 carried (already merged via build(deps): bump sqlalchemy from 2.0.51 to 2.0.52 in /backend #203).Hermes coder CI triage — automated.