fix: remediate 19 trivy-fs CVEs at the develop base + map non-list MinerU JSON to 502

[seonghobae]

1. Security: remediate 19 trivy-fs CVEs in uv.lock at the develop base

The central Security Scan trivy-fs gate fails on develop with 19 CRITICAL/HIGH/MEDIUM findings (ignore-unfixed: true), and because every open PR inherits the base uv.lock, this blocks the whole repo's PR queue. Remediated at the shared base:

package	bump	CVEs cleared
pillow	12.2.0 → 12.3.0	54058, 54059, 54060, 55379, 55380, 59197, 59198, 59199, 59200, 59203, 59204, 59205, 55798 (13)
pypdf	6.13.3 → 6.14.2	59935, 59936, 59937, 59938 (4)
setuptools	81.0.0 → 83.0.0	59890 (1)

All within the existing pyproject.toml ranges (Pillow>=11.0,<13.0, pypdf>=6.13.3,<7.0) — pyproject.toml is unchanged; only uv.lock moved.

The one remaining finding, CVE-2026-61632 in pymdown-extensions (<11.0.1), is a docs-build-only transitive dep (via mkdocs-material) that never ships in the API image or runtime. Its fix needs mkdocs-material >= 9.7, which the repo deliberately avoids (test_docs_theme_range_stays_below_warning_release pins mkdocs-material < 9.7 to keep the "mkdocs 2.0" deprecation banner out of mkdocs build --strict). It is recorded as a documented, time-boxed accepted-risk .trivyignore entry (MEDIUM 5.3) with a revisit date, satisfying the suppression-contract test. HIGH/CRITICAL and all runtime-facing findings are fixed, not ignored — the gate is not weakened.

2. Correctness: map non-list MinerU JSON to the documented 502

_parse_mineru_output read the content-list and model JSON artifacts but never validated their top-level shape, so a syntactically valid MinerU output that is not a JSON array (e.g. {} or a bare string) slipped through and failed downstream in dom_builder as an unhandled 500 — violating the documented contract that incomplete MinerU output maps to 502. The fix validates that both artifacts deserialize to lists and raises the typed, sanitized MineruIncompleteOutputError (no path leakage) otherwise. Added parametrized non-list content-list and model tests mirroring the existing malformed-JSON path tests.

Git Flow target

fix/* → develop. No release/hotfix back-merge needed.

Verification

• PYTHONWARNINGS=error uv run pytest -m "not integration" --cov=src/newsdom_api --cov-branch --cov-fail-under=100 → 432 passed, 100% branch coverage
• uv lock --check → clean (lock consistent with pyproject)
• uv run mkdocs build --strict → passes on the retained mkdocs-material 9.6.23
• pillow/pypdf/setuptools confirmed bumped in uv.lock; pyproject.toml net-unchanged

Notes

• Trivy honours the repo-root .trivyignore via its default --ignorefile, so the single documented entry clears the residual docs-only MEDIUM.
• The central coverage-evidence sandbox now reports success on this PR's head, so the earlier cross-repo gate note is resolved.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HdCssGnNMhKHNu3TXFstWH

---

Generated by Claude Code

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 8 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 5ea096f2-def6-467a-8f25-c1728f7fcaf0

📥 Commits

Reviewing files that changed from the base of the PR and between e187bb8 and 3733b07.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (7)

• .trivyignore
• CHANGELOG.md
• fuzzers/dom_builder_fuzzer.py
• src/newsdom_api/dom_builder.py
• src/newsdom_api/mineru_runner.py
• tests/test_dom_builder.py
• tests/test_mineru_runner_paths.py

📝 Walkthrough

Walkthrough

문서 빌드 전용 pymdown-extensions의 CVE-2026-61632에 대한 Trivy 억제 엔트리와 영향 범위, 현재 버전 제약, 재검토 조건을 .trivyignore에 추가했습니다.

Changes

Trivy 억제 업데이트

Layer / File(s)	Summary
문서 빌드 CVE 억제 .trivyignore	CVE-2026-61632 억제 엔트리와 pymdown-extensions의 런타임 비설치 사유, mkdocs-material 버전 제약 및 재검토 조건을 문서화했습니다.

Estimated code review effort: 1 (단순) | ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	보안 CVE 수정과 MinerU JSON 502 처리라는 핵심 변경을 모두 포함해 전반적으로 적절한 제목입니다.
Description check	✅ Passed	요구된 Summary, Git Flow target, Verification, Notes 섹션이 모두 포함되어 있고 내용도 충분히 구체적입니다.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/cwlab-pr-audit-governance-1hdcp5

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.trivyignore:
- Around line 31-33: .trivyignore의 CVE-2026-61632 억제 항목에 명시적인 승인 만료 또는 재검토 날짜를
추가하세요. 기존 mkdocs-material 9.7+ 채택 및 pymdown-extensions 백포트 조건은 유지하되, upstream
변경이 없더라도 해당 날짜에 재검토되도록 주석을 업데이트하세요.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: ddecc0e2-9353-435e-9bcd-b7cfe6ab5788

📥 Commits

Reviewing files that changed from the base of the PR and between 04491c0 and e187bb8.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• .trivyignore