chore: combine canonical security fixes on strict-floor lock base - #521
Closed
seonghobae wants to merge 2 commits into
Closed
seonghobae wants to merge 2 commits into
seonghobae wants to merge 2 commits into
Conversation
pip-audit against the runtime lock (uv export --no-dev) flagged real advisories in the exact PDF/image parsing path this service depends on. Re-locked with targeted upgrades (all within the existing pyproject.toml version ranges): - pillow 12.2.0 -> 12.3.0 (PYSEC-2026-3451/3452/3453/3454/3493/3494/3495/3496: eight image-decoder advisories). - pypdf 6.13.3 -> 6.14.2 (CVE-2026-59935/59936/59937/59938: PDF parsing). - click 8.3.2 -> 8.4.2 (PYSEC-2026-2132). - setuptools 81.0.0 -> 83.0.0 (CVE-2026-59890, build tool). Verification: `uv export --frozen --no-emit-project --no-dev | pip-audit` -> No known vulnerabilities found. Lock diff is confined to these four packages and their hashes. Residual (documented, not fixable in place): pymdown-extensions 10.21.3 CVE-2026-61632 requires a major bump to 11.0.0, but mkdocs-material 9.6.x caps pymdown-extensions to <11. It is a docs-build-only dependency (mkdocs), not on the runtime/API surface, so it does not affect the shipped image or the `/parse` path; clearing it needs a coordinated docs-toolchain upgrade. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Msz8Dni5zRaqPatNCmZJZ8
…fting mkdocs-material to 9.7.x The org Security Scan `trivy-fs` job fails on this repo (base branch and every open PR) with: [MEDIUM (security-severity=5.3)] CVE-2026-61632 uv.lock - pymdown-extensions pymdown-extensions 10.21.3 is vulnerable; the fix is 11.0.0+. It could not be upgraded because mkdocs-material 9.6.x pins `pymdown-extensions~=10.2` (i.e. <11). The docs toolchain deliberately held `mkdocs-material<9.7` to avoid the 9.7 "MkDocs 2.0" warning banner (encoded in pyproject, two tests, and CONTRIBUTING.md). That caution-hold now blocks a real security fix and fails required CI, so it is lifted to the minimum extent needed: bump only the theme to `mkdocs-material>=9.7,<9.8` (which relaxes its pymdown-extensions cap to `>=10.2`). The MkDocs *core* stays on the 1.x line (`mkdocs>=1.6,<2.0` unchanged) — the 9.7 theme still builds on MkDocs 1.x. Resulting lock: pymdown-extensions 10.21.3 -> 11.0.1, mkdocs-material 9.6.23 -> 9.7.7 (plus the runtime pillow/pypdf/click and setuptools bumps from the previous commit). Governance re-documented coherently: - CONTRIBUTING.md: explains the theme now tracks 9.7.x for the CVE fix while the MkDocs core stays 1.x; the 9.7 banner is informational and non-fatal under --strict. - tests/test_project_metadata.py: assertions updated to the new pin and the CONTRIBUTING rationale (CVE-2026-61632). Verification: - `uv run --frozen --extra docs mkdocs build --strict` -> builds cleanly (informational MkDocs 2.0 banner only, exit 0). - `uv export --frozen --no-emit-project --all-extras | pip-audit --no-deps` -> No known vulnerabilities found (runtime and full sets). - `PYTHONWARNINGS=error uv run --frozen --all-extras pytest` -> 430 passed. - No src/ change, so the 100% branch-coverage gate is unaffected. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Msz8Dni5zRaqPatNCmZJZ8
Collaborator
Author
|
Closing this integration attempt because the two security branches modify overlapping lock sections and GitHub cannot construct a merge preview. No source change from this temporary branch is required: #467 already contains the reviewed package versions, direct dependency floors, CHANGELOG/CONTRIBUTING rationale, and regression tests. Its one-shot exact-tree lock regeneration remains the deterministic integration path. |
This was referenced Sep 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Temporary integration PR. Base is the strict Pillow/pypdf floor and lock branch from closed #517; head is the previously verified canonical #467 security tree. The merge preview must combine Click 8.4.2, the runtime CVE fixes, CHANGELOG/CONTRIBUTING rationale, and strict direct floors without unrelated dependency cleanup.