fix(backend): bump click to >=8.3.3 to clear PYSEC-2026-2132 (CI #502) - #133
Draft
Sbussiso wants to merge 1 commit into
Draft
fix(backend): bump click to >=8.3.3 to clear PYSEC-2026-2132 (CI #502)#133Sbussiso wants to merge 1 commit into
Sbussiso wants to merge 1 commit into
Conversation
CI run #502 (30306788570) failed the 'Backend tests / Dependency scan (pip-audit)' step: Found 1 known vulnerability in 1 package Name Version ID Fix Versions click 8.3.1 PYSEC-2026-2132 8.3.3 click is a transitive dep via uvicorn. Add click>=8.3.3 to the constraint-dependencies block (existing repo pattern) and regenerate backend/uv.lock. uv resolves click 8.3.1 -> 8.4.2 within uvicorn's accepted range with no other package movement. Verified locally (Python 3.12, matching CI): - pip-audit --strict -> No known vulnerabilities found - ruff check -> All checks passed - pytest -q -> 699 passed Remove once uvicorn's own click pin moves past 8.3.3. The same run's frontend npm-audit failure (GHSA-qwww-vcr4-c8h2, react-router RSC-mode CSRF bypass) is NOT reachable here — the advisory only affects unstable RSC APIs, and this frontend uses BrowserRouter + Routes/Route. npm's only fix is a breaking downgrade to 7.11.0; upstream fix 8.3.0 is unreleased. Left for a human decision; out of scope.
Sbussiso
referenced
this pull request
Jul 27, 2026
Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.3.2 to 9.0.0. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@v8.3.2...v9.0.0) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 9.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Sbussiso
referenced
this pull request
Aug 3, 2026
Bumps [eslint](https://github.com/eslint/eslint) from 9.39.4 to 10.8.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v9.39.4...v10.8.0) --- updated-dependencies: - dependency-name: eslint dependency-version: 10.8.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Sbussiso
referenced
this pull request
Aug 3, 2026
Bumps [eslint](https://github.com/eslint/eslint) from 9.39.4 to 10.8.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v9.39.4...v10.8.0) --- updated-dependencies: - dependency-name: eslint dependency-version: 10.8.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Fixes the Backend tests / Dependency scan (pip-audit) failure from CI run #502 (30306788570) on
dependabot/github_actions/astral-sh/setup-uv-9.0.0.Root cause
pip-audit --strictfailed:clickis a transitive dependency pulled in byuvicorn(hard dep for its CLI). Advisory PYSEC-2026-2132 (fixed in 8.3.3) landed 2026-07-24 and turned the strict scan red even though no application code changed.Fix
Follows the repo's established transitive-advisory-hygiene pattern: add
click>=8.3.3to theconstraint-dependenciesblock inbackend/pyproject.toml(mirrors the existingauthlib/urllib3/idna/starlette/pip/cryptography/joserfc/msgpack/pydantic-settingspins) and regeneratebackend/uv.lock. uv resolvesclick 8.3.1 → 8.4.2within uvicorn's accepted range with no other package movement.Verification (local, Python 3.12 — matches CI)
uv run pip-audit --strict→ No known vulnerabilities found ✅uv run ruff check→ All checks passed ✅uv run pytest -q→ 699 passed ✅Remove this constraint once uvicorn's own click pin moves past 8.3.3.
Out of scope — the other failed step in the same run
The Frontend audit + build / npm audit step also failed in run #502, flagging GHSA-qwww-vcr4-c8h2 (react-router RSC-mode CSRF bypass, high). That advisory's own description states it "only affects your application if you are using the unstable RSC APIs" — this frontend uses
BrowserRouter+Routes/<Route>, not RSC mode (createBrowserRouter/RouterProvider/loaders/actions/<Form>/useFetcherare absent), so the vulnerable path is not reachable. npm's only offered fix is a breaking downgrade toreact-router-dom@7.11.0(current is 7.18.1); the upstream fix (8.3.0) is not yet released. That is a breaking change requiring a human decision and is intentionally not addressed here.This PR targets
dependabot/github_actions/astral-sh/setup-uv-9.0.0so the backend scan can go green and unblock that Dependabot bump. Draft pending CI confirmation.