ci: clear pip-audit advisory backlog blocking eslint PR #201 (run #32779906420) - #213
Draft
Sbussiso wants to merge 1 commit into
Draft
ci: clear pip-audit advisory backlog blocking eslint PR #201 (run #32779906420)#213Sbussiso wants to merge 1 commit into
Sbussiso wants to merge 1 commit into
Conversation
Run #32779906420 (Dependabot eslint 9.39.4 -> 10.9.0) failed the
Backend tests > "Dependency scan (pip-audit)" step on 5 newly-landed
advisories in 3 backend packages — unrelated to the frontend eslint bump:
click 8.3.1 PYSEC-2026-2132 (fix 8.3.3) transitive via uvicorn
cryptography 48.0.1 PYSEC-2026-3552 (fix 50.0.0) transitive via
PYSEC-2026-3553 (fix 49.0.0) clerk-backend-api / authlib
PYSEC-2026-3554 (fix 49.0.0)
pip 26.1.2 PYSEC-2026-3721 (fix 26.2) dev/CI surface only
Per the repo's established constraint-dependencies pattern, bump the
transitive floors so uv resolves past the advisories, and cite the PYSEC
IDs in comments (matching the existing entries for authlib/urllib3/idna/
starlette/joserfc/msgpack/pydantic-settings):
pip >=26.1.2 -> >=26.2
cryptography >=48.0.1 -> >=50.0.0
click (new) >=8.3.3
`uv lock` resolves cleanly, forcing clerk-backend-api 6.0.1 -> 7.0.0 (the
6.x line caps cryptography <49, which blocked 50.0.0). Verified locally:
- ruff check : clean
- pip-audit --strict : No known vulnerabilities found
- pytest -q : 699 passed
These are transitive floors only; remove each line once the carrying
direct dep's own pin clears the version (per inline comments).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CI triage — unblock eslint PR #201 (run #32779906420)
The Dependabot eslint 9.39.4 → 10.9.0 bump (PR #201) went red in the Backend tests job, at the "Dependency scan (pip-audit)" step — not because of the eslint change.
pip-audit --strictflagged 5 newly-landed advisories in 3 backend packages:The frontend bump itself is fine — the Frontend audit + build job passed.
Fix
Follows the repo's existing
constraint-dependenciespattern inbackend/pyproject.toml(same approach already used for authlib, urllib3, idna, starlette, joserfc, msgpack, pydantic-settings): raise the transitive floor souvresolves past the advisory, with a comment citing the PYSEC ID.pip>=26.1.2→>=26.2cryptography>=48.0.1→>=50.0.0click— new entry>=8.3.3uv lockresolves cleanly. It also pulls clerk-backend-api 6.0.1 → 7.0.0, because the 6.x line capscryptography < 49, which blocked the 50.0.0 floor. The backend uses only stable clerk API surface (Clerk(),clerk.organizations.*,clerk.organization_memberships.list,authenticate_request,AuthenticateRequestOptions) — all still exported in 7.0.0.Verified locally (mirrors the CI job)
uv run ruff check→ All checks passed!uv run pip-audit --strict→ No known vulnerabilities found ← the step that faileduv run pytest -q→ 699 passedNotes
— Hermes coder automated CI triage