build(deps): clear 4 pip-audit advisories — fixes CI run #595 (click/cryptography/pip) - #215
Draft
Sbussiso wants to merge 1 commit into
Draft
build(deps): clear 4 pip-audit advisories — fixes CI run #595 (click/cryptography/pip)#215Sbussiso wants to merge 1 commit into
Sbussiso wants to merge 1 commit into
Conversation
…udit advisories
pip-audit --strict (deploy + weekly-deps-refresh gates) turned red on
run #592: 5 known vulnerabilities in 3 packages.
click 8.3.1 PYSEC-2026-2132 -> fix 8.3.3
cryptography 48.0.1 PYSEC-2026-3552 -> fix 50.0.0
cryptography 48.0.1 PYSEC-2026-3553 -> fix 49.0.0
cryptography 48.0.1 PYSEC-2026-3554 -> fix 49.0.0
pip 26.1.2 PYSEC-2026-3721 -> fix 26.2
All three are transitive deps already managed via [tool.uv]
constraint-dependencies. Bump those pins and regenerate uv.lock:
click >=8.3.3 (transitive via uvicorn)
cryptography >=50.0.0 (clears all four; transitive via
clerk-backend-api / authlib / joserfc)
pip >=26.2 (dev/CI surface only; pulled by pip-audit)
Notable side effect: clerk-backend-api 6.0.1 caps cryptography at
<49.0.0, so fixing cryptography past 49 forces clerk-backend-api
6 -> 7 — a MAJOR bump of the app's auth SDK. Verified safe against
the full backend suite: 699 tests pass under clerk-backend-api 7.0.0
+ cryptography 50.0.0. ruff check and pip-audit --strict both green.
Constraint comments updated to document the new advisories and the
clerk-backend-api major bump, matching the existing style.
Fixes SourceBox-LLC/Sentinel-Command run #592.
Sbussiso
referenced
this pull request
Aug 24, 2026
Closes the Dependabot security-update job failure (run 32779736153, workflow "npm_and_yarn in /frontend for @babel/core", status security_update_not_possible). Root cause: @babel/core 7.29.0 is vulnerable to GHSA-4x5r-pxfx-6jf8 (Arbitrary File Read via sourceMappingURL Comment, low / CVSS 3.2), pulled transitively via eslint-plugin-react-hooks@7.1.1 -> @babel/helper-module-transforms@7.28.6. Dependabot could not auto-fix because the only automated path it found would downgrade eslint-plugin-react-hooks 7.1.1 -> 5.2.0, which it refuses to do. Fix: add an npm `overrides` entry pinning @babel/core to ^7.29.7 (the latest patched 7.x). 7.29.7 satisfies eslint-plugin-react-hooks' ^7.24.4 and @babel/helper-module-transforms' ^7.0.0, so the override resolves the advisory with NO downgrade of any package. Matches the existing postcss/js-cookie override pattern and documents the rationale in overridesNotes. Verified: npm install clean, build green, vitest 85/85 green, lint unchanged (38 pre-existing problems, none new), npm audit no longer lists @babel/core (remaining brace-expansion/nanoid highs are pre-existing and unrelated). The vulnerability is not reachable in our build (Vite/babel transforms source we control; no attacker-supplied sourceMap) but the override lets Dependabot resolve cleanly and keeps the audit-level gate honest. Remove the override once eslint-plugin-react-hooks ships against a >=7.29.6 baseline or @babel/core 8 is adopted.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Root cause — CI run #595 (workflow "Test & Deploy", job "Backend tests / Dependency scan (pip-audit)")
uv run pip-audit --strictfailed with 5 known vulnerabilities in 3 packages on commita977eb2(branchci-fix/32779736153):All three are transitive deps already managed via
[tool.uv] constraint-dependenciesinbackend/pyproject.toml. The committeduv.lock(ata977eb2and atmaster) still resolved the old vulnerable versions, sopip-audit --strictturned red even though no application code changed — the advisories landed during a quiet week.Fix
Bump the three constraint floors and regenerate
backend/uv.lock:click>=8.3.3(transitive via uvicorn) — clears PYSEC-2026-2132cryptography>=50.0.0(transitive via clerk-backend-api / authlib / joserfc) — clears PYSEC-2026-3552/3553/3554 (50.0.0 is the minimum satisfying all four advisories)pip>=26.2(dev/CI surface only — pulled in by pip-audit to resolve deps, then--strictaudits pip itself; pip is NOT shipped in the app image) — clears PYSEC-2026-3721Constraint comments updated to document the new advisories and the removal conditions, matching the existing style.
Side effect: clerk-backend-api 6 → 7 (MAJOR)
clerk-backend-api6.0.1 capscryptographyat<49.0.0, so fixing cryptography past 49 forcesclerk-backend-api6 → 7 — a MAJOR bump of the app's auth SDK. Verified safe against the full backend suite (see below). Dependabot already tracks this bump in PR #185.Verification (run locally in the sandbox, Python 3.12, uv 0.11.29)
Reproduced the CI steps against this branch:
All three CI gates green. The pip-audit step that failed on run #595 now passes.
Note on duplicate PRs — please merge ONE
This is the same fix that already exists on:
ci-fix/32779951393, commit5816824) — verified identical, 699 tests pass — but it targets baseci-fix/32779463077, notci-fix/32779736153, so it does not reach this failed commit.There are currently ~25 open
ci-fix/*PRs, many duplicating this pip-audit fix against different base branches. This PR exists to give commita977eb2/ branchci-fix/32779736153a directly-mergeable fix. A human should pick exactly one of these to merge into master (and close the rest) rather than merging several — they're all the same change. Retitling/rebasing #212 onto master is the cleanest path; this draft is the fallback that lands the fix on the specific branch run #595 failed on.Hermes coder CI triage — run #595 (id 32780121408), branch
ci-fix/32779736153, commita977eb2.