build(deps): clear 4 pip-audit advisories (click/cryptography/pip) — fixes run #592 - #212
Draft
Sbussiso wants to merge 1 commit into
Draft
build(deps): clear 4 pip-audit advisories (click/cryptography/pip) — fixes run #592#212Sbussiso wants to merge 1 commit into
Sbussiso wants to merge 1 commit into
Conversation
…udit advisories
pip-audit --strict (deploy + weekly-deps-refresh gates) turned red on
run #592: 5 known vulnerabilities in 3 packages.
click 8.3.1 PYSEC-2026-2132 -> fix 8.3.3
cryptography 48.0.1 PYSEC-2026-3552 -> fix 50.0.0
cryptography 48.0.1 PYSEC-2026-3553 -> fix 49.0.0
cryptography 48.0.1 PYSEC-2026-3554 -> fix 49.0.0
pip 26.1.2 PYSEC-2026-3721 -> fix 26.2
All three are transitive deps already managed via [tool.uv]
constraint-dependencies. Bump those pins and regenerate uv.lock:
click >=8.3.3 (transitive via uvicorn)
cryptography >=50.0.0 (clears all four; transitive via
clerk-backend-api / authlib / joserfc)
pip >=26.2 (dev/CI surface only; pulled by pip-audit)
Notable side effect: clerk-backend-api 6.0.1 caps cryptography at
<49.0.0, so fixing cryptography past 49 forces clerk-backend-api
6 -> 7 — a MAJOR bump of the app's auth SDK. Verified safe against
the full backend suite: 699 tests pass under clerk-backend-api 7.0.0
+ cryptography 50.0.0. ruff check and pip-audit --strict both green.
Constraint comments updated to document the new advisories and the
clerk-backend-api major bump, matching the existing style.
Fixes SourceBox-LLC/Sentinel-Command run #592.
Sbussiso
force-pushed
the
ci-fix/32779951393
branch
from
August 24, 2026 21:36
5816824 to
796db3a
Compare
Sbussiso
referenced
this pull request
Aug 24, 2026
Closes the Dependabot security-update job failure (run 32779736153, workflow "npm_and_yarn in /frontend for @babel/core", status security_update_not_possible). Root cause: @babel/core 7.29.0 is vulnerable to GHSA-4x5r-pxfx-6jf8 (Arbitrary File Read via sourceMappingURL Comment, low / CVSS 3.2), pulled transitively via eslint-plugin-react-hooks@7.1.1 -> @babel/helper-module-transforms@7.28.6. Dependabot could not auto-fix because the only automated path it found would downgrade eslint-plugin-react-hooks 7.1.1 -> 5.2.0, which it refuses to do. Fix: add an npm `overrides` entry pinning @babel/core to ^7.29.7 (the latest patched 7.x). 7.29.7 satisfies eslint-plugin-react-hooks' ^7.24.4 and @babel/helper-module-transforms' ^7.0.0, so the override resolves the advisory with NO downgrade of any package. Matches the existing postcss/js-cookie override pattern and documents the rationale in overridesNotes. Verified: npm install clean, build green, vitest 85/85 green, lint unchanged (38 pre-existing problems, none new), npm audit no longer lists @babel/core (remaining brace-expansion/nanoid highs are pre-existing and unrelated). The vulnerability is not reachable in our build (Vite/babel transforms source we control; no attacker-supplied sourceMap) but the override lets Dependabot resolve cleanly and keeps the audit-level gate honest. Remove the override once eslint-plugin-react-hooks ships against a >=7.29.6 baseline or @babel/core 8 is adopted.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CI failure this fixes
Run #592 —
Test & Deploy, Dependency scan (pip-audit) step failed:uv run pip-audit --strictreported 5 known vulnerabilities in 3 packages:Root cause
Four new advisories landed in the PyPA advisory DB (~2026-W34). All three
packages are transitive deps already managed via
[tool.uv] constraint-dependenciesin
backend/pyproject.toml; their old pins are now below the fixed versions,so
--strictexits 1 and blocks the deploy.Fix
Bump the transitive constraints and regenerate
backend/uv.lock:click >= 8.3.3(transitive via uvicorn)cryptography >= 50.0.0— minimum that clears all four advisoriespip >= 26.2(dev/CI surface only; pulled in by pip-audit itself)Constraint comments updated to document the new advisories, matching the
existing style.
clerk-backend-api 6.0.1capscryptography < 49.0.0, so fixingcryptography past 49 forces
clerk-backend-apifrom 6.0.1 → 7.0.0 — amajor version bump of the app's auth SDK. I investigated alternatives and
this is unavoidable: cryptography 49+ requires clerk-backend-api 7+.
Verification (all three CI gates, run locally in the sandbox)
uv run pip-audit --strictuv run ruff checkuv run pytest -qThe major auth-SDK bump is empirically safe: the full backend suite stays
green under
clerk-backend-api 7.0.0 + cryptography 50.0.0.Draft because the clerk-backend-api major bump warrants a human eyeball
before merge, even though the test suite is green.
Triage by Hermes coder for CI failure run #592.