fix(security): clear 19 trivy-fs CVEs in uv.lock at base by seonghobae · Pull Request #456 · ContextualWisdomLab/newsdom-api

seonghobae · 2026-07-29T18:49:07Z

Summary

The org-central Security Scan (trivy-fs, CRITICAL,HIGH,MEDIUM, ignore-unfixed) reports 19 fixable CVEs against uv.lock on every open PR (base = develop). Per the gate's own guidance — "Remediate each finding at the shared base branch so open PRs inherit the fix" — this remediates all 19 at the base:

Package	`uv.lock`	→	CVEs cleared
Pillow	12.2.0	12.3.0	CVE-2026-54058/54059/54060/55379/55380/55798/59197/59198/59199/59200/59203/59204/59205 (decodes untrusted uploaded PDFs)
pypdf	6.13.3	6.14.2	CVE-2026-59935/59936/59937/59938 — parser DoS (validates untrusted PDFs)
setuptools	81.0.0	83.0.0	CVE-2026-59890
pymdown-extensions	10.21.3	11.0.1	CVE-2026-61632 (b64 path traversal) + CVE-2026-67422 (ReDoS)

Pillow and pypdf floors are bumped directly (both parse untrusted uploads). setuptools and pymdown-extensions are transitive, so they're pinned via [tool.uv] constraint-dependencies rather than added as runtime deps.

The pymdown fix exists only in the 11.x line, and Material 9.6.x caps pymdown-extensions at ~=10.2. The documented docs-toolchain hold's stated condition (mkdocs build --strict breaking on the newer Material line) no longer holds: mkdocs build --strict is validated green on mkdocs-material 9.7.7, so the docs-only floor advances >=9.7,<9.8 instead of the hold being broken. Contract tests and CONTRIBUTING.md are updated to the new validated range.

Git Flow target

fix/* targeting develop ✓ (security fix on the integration branch so all open PRs inherit it)

Verification

pytest — 430 passed
PYTHONWARNINGS=error pytest --cov=src/newsdom_api --cov-branch --cov-fail-under=100 — 100% branch coverage
uv lock --locked — lockfile consistent with pyproject.toml
uv run mkdocs build --strict — passes on mkdocs-material 9.7.7
tests/test_project_metadata.py / tests/test_changelog.py / tests/test_dependabot.py — pass

Notes

Base-branch security remediation; no runtime behavior change (dependency version bumps only). CHANGELOG.md [Unreleased] / ### Security records the change. No release or hotfix back-merge follow-up required.

Generated by Claude Code

The org-central Security Scan (trivy-fs, severity CRITICAL/HIGH/MEDIUM, ignore-unfixed) reported 19 fixable CVEs against uv.lock on every open PR (base = develop). Remediate at the shared base so open PRs inherit the fix: - Pillow 12.2.0 -> 12.3.0: clears the 2026 image-decoder CVE batch (CVE-2026-54058/54059/54060/55379/55380/55798/59197/59198/59199/59200/ 59203/59204/59205). Pillow decodes untrusted uploaded PDFs. - pypdf 6.13.3 -> 6.14.2: clears the parser DoS batch (CVE-2026-59935/59936/59937/59938). pypdf validates untrusted PDFs. - setuptools 81.0.0 -> 83.0.0: clears CVE-2026-59890 (transitive; pinned via [tool.uv] constraint-dependencies, not added as a runtime dep). - pymdown-extensions 10.21.3 -> 11.0.1: clears CVE-2026-61632 (b64 extension path traversal) and CVE-2026-67422 (ReDoS). The fix exists only in the 11.x line, so the docs-only mkdocs-material floor moves to >=9.7,<9.8 (9.6.x caps pymdown-extensions at ~=10.2). `mkdocs build --strict` is validated green on mkdocs-material 9.7.7, so the documented docs-toolchain hold advances from <9.7 to <9.8 rather than being broken. Contract tests (test_project_metadata) and CONTRIBUTING.md are updated to the new validated range; CHANGELOG [Unreleased]/Security records the remediation. Full suite: 430 passed, 100% branch coverage. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AqtiEQFfuYFsS75Aku9tPT

coderabbitai · 2026-07-29T18:49:16Z

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 53 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 77905450-cfe8-4f0f-b634-3ae84d6b7032

📥 Commits

Reviewing files that changed from the base of the PR and between 04491c0 and ffb9393.

⛔ Files ignored due to path filters (1)

uv.lock is excluded by !**/*.lock

📒 Files selected for processing (4)

CHANGELOG.md
CONTRIBUTING.md
pyproject.toml
tests/test_project_metadata.py

_{Comment @coderabbitai help to get the list of available commands.}

seonghobae · 2026-08-03T02:13:43Z

@coderabbitai review

coderabbitai · 2026-08-03T02:13:49Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

seonghobae · 2026-08-03T02:29:46Z

@coderabbitai review

coderabbitai · 2026-08-03T02:29:51Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

seonghobae · 2026-08-03T02:43:59Z

@jules Please extend this security rollup with the remaining Click advisory evidenced by the repository’s current dependency scans. On this PR branch only: determine the minimum patched Click version from the current lock/advisory data, add the narrowest transitive constraint needed, refresh only the affected lock entries, extend the dependency-floor regression test and CHANGELOG, and run the full warnings-as-errors/100% branch-coverage, strict docs-build, lock-consistency, and security checks. Do not modify unrelated files or weaken any security gate.

seonghobae · 2026-08-03T02:49:04Z

@claude Please complete the canonical base remediation before merge: the current branch still leaves Click 8.3.2, while #467 identified the fixable PYSEC-2026-2132 advisory and resolved it at Click 8.4.2. Add click>=8.4.2 to [tool.uv].constraint-dependencies, regenerate uv.lock, include Click in test_uv_lock_pins_all_security_remediations and the Unreleased > Security changelog line, then run uv lock --check, strict docs, full warnings-as-errors tests with 100% branch/docstring coverage, pip-audit, and trivy-fs. Push only the minimal current-head update and request fresh review.

seonghobae · 2026-08-03T02:55:31Z

@coderabbitai review

coderabbitai · 2026-08-03T02:55:38Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

seonghobae · 2026-08-03T03:02:03Z

@coderabbitai help

coderabbitai · 2026-08-03T03:02:08Z

Chat

There are 3 ways to chat with CodeRabbit:

Review comments: Directly reply to a review comment made by CodeRabbit. Example:
- I pushed a fix in commit <commit_id>, please review it.
- Open a follow-up GitHub issue for this discussion.
Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query.
PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
- @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
- @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.

CodeRabbit commands

These commands are invoked using PR/Issue comments.

@coderabbitai pause to pause the reviews on a PR.
@coderabbitai resume to resume the paused reviews.
@coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
@coderabbitai full review to do a full review from scratch and review all the files again.
@coderabbitai rate limit to show your current review rate limit status.
@coderabbitai summary to regenerate the summary of the PR.
@coderabbitai evaluate custom pre-merge check --instructions <custom-checks-instructions> --name <custom-checks-title> [--mode <error|warning>] to validate the custom pre-merge checks instructions. Defaults to error when --mode is omitted.
@coderabbitai ignore pre-merge checks to override pre-merge checks and get an approval on PR.
@coderabbitai run pre-merge checks to run pre-merge checks on the pull request.
@coderabbitai generate docstrings to generate docstrings for this PR.
@coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
@coderabbitai generate unit tests to generate unit tests for this PR.
@coderabbitai emit path instructions to emit generated path-specific review instructions for this repository.
@coderabbitai resolve merge conflict to automatically resolve merge conflicts.
@coderabbitai autofix to automatically fix issues identified in unresolved review comments.
@coderabbitai fix-ci to automatically fix failing CI checks in a stacked pull request.
@coderabbitai fix-ci commit to automatically fix failing CI checks by committing fixes to the current branch.
@coderabbitai resolve to resolve all the CodeRabbit review comments.
@coderabbitai configuration to show the current CodeRabbit configuration for the repository.
@coderabbitai generate configuration to create a PR that adds the current resolved configuration as .coderabbit.yaml (or show it if already present).
@coderabbitai help to get help.

Other keywords and placeholders

Add @coderabbitai ignore or @coderabbit ignore anywhere in the PR description to prevent this PR from being reviewed.
Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
Add @coderabbitai anywhere in the PR title to generate the title automatically.

Status, support, documentation and community

Visit our status page to check the current availability of CodeRabbit.
Create a ticket on our support page for assistance with any issues or questions.
Visit our documentation site for detailed information on how to use CodeRabbit.
Join our Discord community to connect with other users and get help from the community.
Follow us on X/Twitter for updates and announcements.

seonghobae · 2026-08-03T03:02:49Z

Closing as superseded by #467. This branch remediates Pillow, pypdf, setuptools, and pymdown-extensions, but its lockfile still resolves Click 8.3.2 and therefore omits PYSEC-2026-2132. PR #467 carries the complete, internally consistent lockfile remediation (including Click 8.4.2), the validated MkDocs Material 9.7 compatibility change, governance documentation, metadata tests, and a prior all-green nine-workflow verification on head 4ba5e81d8dba98fc97ba2f6964751cc958b58c9e. Keeping one canonical security PR avoids duplicate required-workflow load and divergent lockfile policy.

seonghobae · 2026-08-03T03:19:58Z

Superseded by #467, which contains the same base-branch Pillow/pypdf/setuptools/pymdown remediation plus the independently detected Click advisory and a clean full-lock pip-audit result. Preserving this branch as regression-test source; the patched-version floor assertions will be carried forward after the complete security rollup lands.

seonghobae enabled auto-merge (squash) August 3, 2026 02:13

test(security): lock patched dependency floors

ffb9393

seonghobae mentioned this pull request Aug 3, 2026

fix(dom_builder): skip non-dict content_list blocks to avoid AttributeError on untrusted MinerU JSON #465

Closed

3 tasks

seonghobae marked this pull request as draft August 3, 2026 02:56

auto-merge was automatically disabled August 3, 2026 02:56
Pull request was converted to draft

seonghobae marked this pull request as ready for review August 3, 2026 02:56

seonghobae enabled auto-merge (squash) August 3, 2026 02:56

seonghobae closed this Aug 3, 2026

auto-merge was automatically disabled August 3, 2026 03:02
Pull request was closed

seonghobae reopened this Aug 3, 2026

seonghobae enabled auto-merge (squash) August 3, 2026 03:16

seonghobae closed this Aug 3, 2026

auto-merge was automatically disabled August 3, 2026 03:20
Pull request was closed

Uh oh!

Conversation

seonghobae commented Jul 29, 2026

Summary

Git Flow target

Verification

Notes

Uh oh!

coderabbitai Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

seonghobae commented Aug 3, 2026

Uh oh!

coderabbitai Bot commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

seonghobae commented Aug 3, 2026

Uh oh!

coderabbitai Bot commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

seonghobae commented Aug 3, 2026

Uh oh!

seonghobae commented Aug 3, 2026

Uh oh!

seonghobae commented Aug 3, 2026

Uh oh!

coderabbitai Bot commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

seonghobae commented Aug 3, 2026

Uh oh!

coderabbitai Bot commented Aug 3, 2026

Chat

CodeRabbit commands

Other keywords and placeholders

Status, support, documentation and community

Uh oh!

seonghobae commented Aug 3, 2026

Uh oh!

seonghobae commented Aug 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai Bot commented Jul 29, 2026 •

edited

Loading

coderabbitai Bot commented Aug 3, 2026 •

edited

Loading

coderabbitai Bot commented Aug 3, 2026 •

edited

Loading

coderabbitai Bot commented Aug 3, 2026 •

edited

Loading