fix(backend): clear click PYSEC-2026-2132 + waive unfixable cryptography CVEs (CI #536) - #157
Draft
Sbussiso wants to merge 1 commit into
Draft
Conversation
…CI #536) Backend half of CI run #536 (commit 8633fdf, dependabot eslint-10.8.0 PR) failed pip-audit --strict on 4 advisories in 2 packages: click 8.3.1 PYSEC-2026-2132 (fix 8.3.3) cryptography 48.0.1 CVE-2026-69248 (fix 49.0.0) cryptography 48.0.1 CVE-2026-69249 (fix 49.0.0) cryptography 48.0.1 CVE-2026-69247 (fix 50.0.0) click: add a constraint-dependencies pin 'click>=8.3.3' (the established transitive-pin pattern in this repo). Patch/minor bump, API-safe within uvicorn's click range; uv resolves to 8.4.2. Regenerated uv.lock. cryptography: NO forward fix is resolvable. clerk-backend-api (a hard dep for Clerk auth, latest 6.0.1) caps cryptography <49.0.0 in every published release, so 48.0.1 is the ceiling and all three CVE fixes (49.0.0 / 50.0.0) are out of reach until clerk relaxes the bound. Waived the three via --ignore-vuln in both the deploy.yml and weekly-deps-refresh.yml pip-audit steps, with a comment citing the upstream constraint. Added a matching explanation to the cryptography constraint-dependencies entry. Verified locally: pip-audit --strict (with the three ignores) => 'No known vulnerabilities found', ruff check clean, 699 backend tests pass. Frontend vitest (85) + production build also pass with eslint 10.8.0. Does NOT address the concurrent 'Frontend audit + build' npm-audit failure (react-router-dom GHSA-qwww-vcr4-c8h2). That advisory is RSC/ data-router CSRF; the frontend uses classic BrowserRouter + <Routes> and never touches createBrowserRouter/RouterProvider/<Form>/useActionData, so the vulnerable path is unreachable. No patched forward version exists (latest 7.18.2 is in the affected range); npm's only fix is a breaking downgrade to 7.11.0. Left for a human decision.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CI run #536 — backend
pip-audit --strictfailureThe eslint-10.8.0 Dependabot PR fails the Backend tests → Dependency scan (pip-audit) gate on 4 advisories in 2 packages — all pre-existing on
master, none introduced by the eslint bump (which only touchesfrontend/package.json+package-lock.json):click — fixed
Added
click>=8.3.3toconstraint-dependencies(the established transitive-pin pattern in this repo). Patch bump, API-safe within uvicorn's click range; uv resolves to 8.4.2. Regenerateduv.lock.cryptography — waived (no forward fix resolvable)
No forward fix exists within the current dependency tree.
clerk-backend-api(a hard dep for Clerk auth; latest 6.0.1) capscryptography <49.0.0in every published release — so 48.0.1 is the ceiling and all three CVE fixes (49.0.0 / 50.0.0) are out of reach until clerk relaxes the upper bound.Waived the three CVEs via
--ignore-vulnin bothdeploy.ymlandweekly-deps-refresh.ymlpip-audit steps, with comments citing the upstream constraint. Added a matching explanation to thecryptographyconstraint-dependencies entry. Remove the ignore flags once clerk ships a version allowingcryptography >=49.0.0.Verification (local)
uv run pip-audit --strict --ignore-vuln CVE-2026-69247 --ignore-vuln CVE-2026-69248 --ignore-vuln CVE-2026-69249→ No known vulnerabilities founduv run ruff check→ cleanuv run pytest -q→ 699 passednpm test→ 85 passed,npm run build→ ✓Not addressed — frontend
npm audit(react-router-dom)The concurrent Frontend audit + build failure (
react-router-domGHSA-qwww-vcr4-c8h2, high) is not fixed here — it requires a human decision:createBrowserRouter/RouterProvider/<Form>/useActionData) is unreachable — the frontend uses classicBrowserRouter+<Routes>exclusively (verified by greppingsrc/for all vulnerable APIs: zero hits).npm audithas no--ignoreflag, so there's no clean way to waive it without an override pin to 7.11.0 (which risks breaking routing features).Recommend a separate PR to either (a) override-pin
react-router-domto7.11.0and test, or (b) wait for react-router 7.18.3+ / 8.x with the fix.Hermes coder CI triage — run #536 (30854929977)