From 2b5b6b088297270539c86b6457ed772ea5b44258 Mon Sep 17 00:00:00 2001
From: Hermes coder <hermes-coder@sourceboxai.com>
Date: Mon, 27 Jul 2026 21:31:36 +0000
Subject: [PATCH] fix(backend): pin click>=8.3.3 to clear PYSEC-2026-2132 (CI
 run #511)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

pip-audit --strict started failing on click 8.3.1 (PYSEC-2026-2132,
fixed in 8.3.3) — a transitive dep pulled in via uvicorn. The
advisory landed in the PyPA DB after the last green deploy, so the
strict scan turned red without any code change.

Adds click>=8.3.3 to [tool.uv] constraint-dependencies, matching the
existing pattern used for authlib, urllib3, starlette, pip, etc.
uv lock resolves click -> 8.4.2 (latest, well above the floor).
Locally verified: uv run pip-audit --strict -> 'No known vulnerabilities found'.

This clears the backend Dependency scan (pip-audit) job that failed
in CI run #511. The frontend npm-audit failure in the same run is a
separate, unrelated issue (react-router-dom RSC-mode CSRF bypass,
GHSA-qwww-vcr4-c8h2) with no safe automated fix — documented in the
commit comment on eff42f4.
---
 backend/pyproject.toml |  6 ++++++
 backend/uv.lock        | 11 ++++++-----
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/backend/pyproject.toml b/backend/pyproject.toml
index b9e0eec..f4b0ef2 100644
--- a/backend/pyproject.toml
+++ b/backend/pyproject.toml
@@ -170,4 +170,10 @@ constraint-dependencies = [
     # pydantic-settings: GHSA-4xgf-cpjx-pc3j (fixed in 2.14.2). Transitive
     # via fastmcp. Remove once fastmcp's own pin clears 2.14.2.
     "pydantic-settings>=2.14.2",
+    # click: PYSEC-2026-2132 (fixed in 8.3.3). Transitive via uvicorn
+    # (and mcp / fastmcp-slim which pull uvicorn). Patch bump 8.3.1 → 8.3.3,
+    # API-compatible. pip-audit --strict in CI started failing on it after
+    # the advisory landed in the PyPA DB. Remove once uvicorn's own pin
+    # clears click 8.3.3.
+    "click>=8.3.3",
 ]
\ No newline at end of file
diff --git a/backend/uv.lock b/backend/uv.lock
index a4e4f63..be29de4 100644
--- a/backend/uv.lock
+++ b/backend/uv.lock
@@ -11,6 +11,7 @@ resolution-markers = [
 [manifest]
 constraints = [
     { name = "authlib", specifier = ">=1.7.1" },
+    { name = "click", specifier = ">=8.3.3" },
     { name = "cryptography", specifier = ">=48.0.1" },
     { name = "idna", specifier = ">=3.15" },
     { name = "joserfc", specifier = ">=1.6.7" },
@@ -309,14 +310,14 @@ wheels = [
 
 [[package]]
 name = "click"
-version = "8.3.1"
+version = "8.4.2"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "colorama", marker = "sys_platform == 'win32'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/3d/fa/656b739db8587d7b5dfa22e22ed02566950fbfbcdc20311993483657a5c0/click-8.3.1.tar.gz", hash = "sha256:12ff4785d337a1bb490bb7e9c2b1ee5da3112e94a8622f26a6c77f5d2fc6842a", size = 295065, upload-time = "2025-11-15T20:45:42.706Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/76/d4/81420972a676e8ffea40450d8c8c92943e7218a78fe9b64359836cc9876b/click-8.4.2.tar.gz", hash = "sha256:9a6cea6e60b17ebe0a44c5cc636d94f09bd66142c1cd7d8b4cd731c4917a15f6", size = 338000, upload-time = "2026-06-24T17:45:15.148Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/98/78/01c019cdb5d6498122777c1a43056ebb3ebfeef2076d9d026bfe15583b2b/click-8.3.1-py3-none-any.whl", hash = "sha256:981153a64e25f12d547d3426c367a4857371575ee7ad18df2a6183ab0545b2a6", size = 108274, upload-time = "2025-11-15T20:45:41.139Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/e2/79c688af8b210d232694e31e59da9f6ec747bae31c3f5946e4e9b98860d5/click-8.4.2-py3-none-any.whl", hash = "sha256:e6f9f66136c816745b9d65817da91d61d957fb16e02e4dcd0552553c5a197b76", size = 119243, upload-time = "2026-06-24T17:45:13.73Z" },
 ]
 
 [[package]]
@@ -1665,8 +1666,8 @@ name = "secretstorage"
 version = "3.5.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "cryptography", marker = "sys_platform != 'win32'" },
-    { name = "jeepney", marker = "sys_platform != 'win32'" },
+    { name = "cryptography" },
+    { name = "jeepney" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/1c/03/e834bcd866f2f8a49a85eaff47340affa3bfa391ee9912a952a1faa68c7b/secretstorage-3.5.0.tar.gz", hash = "sha256:f04b8e4689cbce351744d5537bf6b1329c6fc68f91fa666f60a380edddcd11be", size = 19884, upload-time = "2025-11-23T19:02:53.191Z" }
 wheels = [