fix(security): bump pillow, pypdf, click, setuptools to clear known advisories - #466
Closed
seonghobae wants to merge 2 commits into
Closed
fix(security): bump pillow, pypdf, click, setuptools to clear known advisories#466seonghobae wants to merge 2 commits into
seonghobae wants to merge 2 commits into
Conversation
`pip-audit` / the central Security Scan trivy-fs gate (severity
CRITICAL/HIGH/MEDIUM, ignore-unfixed=true) flag fixable advisories in the
resolved dependency graph. Bump the four packages whose fixes are
range-compatible and verified, regenerating uv.lock only (no source or
pyproject constraint changes; diff scoped to exactly these packages):
pillow 12.2.0 -> 12.3.0 (PYSEC-2026-2253/2254/2255/2256,
3451-3454, 3493-3496)
pypdf 6.13.3 -> 6.14.2 (CVE-2026-59935/59936/59937/59938)
click 8.3.2 -> 8.4.2 (PYSEC-2026-2132; transitive via uvicorn)
setuptools 81.0.0 -> 83.0.0 (PYSEC-2026-3447)
pillow and pypdf are direct dependencies whose existing pyproject ranges
(`Pillow>=11.0,<13.0`, `pypdf>=6.13.3,<7.0`) already permit the patched
releases; click and setuptools are transitive/build deps.
Verification:
- pip-audit (uv-exported runtime lock) => No known vulnerabilities found
- PYTHONWARNINGS=error uv run pytest --cov=src/newsdom_api --cov-branch
--cov-fail-under=100 => 430 passed, 100% branch coverage, no warnings
- uv run mkdocs build --strict => builds clean
Not included: pymdown-extensions (CVE-2026-61632, fixed in 11.0.0) is a
docs-build-only dependency whose fix requires mkdocs-material >= 9.7, but
that upper bound is deliberately pinned `<9.7` and enforced by
tests/test_project_metadata.py::test_docs_theme_range_stays_below_warning_release
(9.7 emits the mkdocs-2.0 deprecation warning). It is not runtime-reachable
and needs a separate maintainer decision (coordinated docs-framework bump
or a documented .trivyignore entry), so it is intentionally left out here.
Co-Authored-By: Claude <noreply@anthropic.com>
📝 WalkthroughWalkthrough
Changes보안 검사 억제
Estimated code review effort: 1 (Trivial) | ~5 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
…ppression The central Security Scan trivy-fs gate reports one residual finding after the pillow/pypdf/click/setuptools bumps (run 30518852808): [MEDIUM (security-severity=5.3)] CVE-2026-61632 uv.lock:1 Package: pymdown-extensions pymdown-extensions is a docs-build-only dependency (renders the MkDocs manual) and is never imported by the runtime FastAPI service under src/newsdom_api, so the path-traversal is not reachable in the shipped API. Its fix (>= 11.0.0) is only pulled by mkdocs-material >= 9.7, but that upper bound is intentionally pinned "<9.7" and enforced by tests/test_project_metadata.py::test_docs_theme_range_stays_below_warning_release (9.7 emits the mkdocs-2.0 deprecation warning that `mkdocs build --strict` rejects). Fixing here is therefore blocked by a deliberate, tested constraint. Add a single, documented, time-boxed .trivyignore entry following the repo's contract (rule id named, artifact + why-unfixable, revisit condition), reproduced from the trivy-fs job log per the file's own instructions. The gate is not weakened: every other advisory still fails the build, and this entry is revisited when the docs theme is bumped or by 2026-10-31. Verification: - tests/test_fuzzing_integration.py (.trivyignore contract) => 21 passed - PYTHONWARNINGS=error uv run pytest => 430 passed (100% branch coverage) Co-Authored-By: Claude <noreply@anthropic.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.trivyignore:
- Around line 23-36: Limit the CVE-2026-61632 suppression to uv.lock instead of
applying it globally through .trivyignore. Move the entry to .trivyignore.yaml
using its paths configuration and ensure the Trivy scan reads that file, or
remove the suppression after upgrading the affected documentation dependencies.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 36ee9a57-1fea-43ad-ac4f-555fbe4dec3a
⛔ Files ignored due to path filters (1)
uv.lockis excluded by!**/*.lock
📒 Files selected for processing (1)
.trivyignore
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The central Security Scan
trivy-fsgate (severity CRITICAL/HIGH/MEDIUM,ignore-unfixed=true) flagged five advisories in the resolved dependency graph. This PR clears all of them — four by bumping the vulnerable package, one (docs-build-only, blocked from a clean fix) by a documented suppression.Fixed by dependency bump (
uv.lockonly, diff scoped to these packages)pillow/pypdfare direct deps whose existing ranges already permit the patched releases;click/setuptoolsare transitive/build deps. Nopyprojectconstraint changes.Handled by documented
.trivyignoreentryCVE-2026-61632(MEDIUM 5.3) onpymdown-extensions— a docs-build-only dependency never imported by the runtime FastAPI service undersrc/newsdom_api, so it is not reachable in the shipped API. Its fix (≥ 11.0.0) requiresmkdocs-material ≥ 9.7, but that upper bound is intentionally pinned<9.7and enforced bytests/test_project_metadata.py::test_docs_theme_range_stays_below_warning_release(9.7 emits the mkdocs-2.0 deprecation warning thatmkdocs build --strictrejects) — so a clean fix is blocked by a deliberate, tested constraint. Added a single, time-boxed, documented.trivyignoreentry per the repo's contract (rule id named, artifact + why-unfixable, revisit condition), reproduced from the trivy-fs job log. The gate is not weakened — every other advisory still fails the build.Git Flow target
fix/*targetsdevelop✔.Verification
PYTHONWARNINGS=error uv run pytest --cov=src/newsdom_api --cov-branch --cov-fail-under=100→ 430 passed, 100% branch coverage, no warningstests/test_fuzzing_integration.py(.trivyignorecontract) → 21 passeduv run mkdocs build --strict→ builds cleanpip-auditon the uv-exported runtime lock → No known vulnerabilities foundNotes
Summary by CodeRabbit