fix(deps): update python-dotenv, pytest, and md2pdf to fix snyk vulne… - #46
Conversation
📝 WalkthroughWalkthroughThree Python dependencies are upgraded in ChangesSecurity Dependency Updates and Remediation
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning Review ran into problems🔥 ProblemsStopped waiting for pipeline failures after 30000ms. One of your pipelines takes longer than our 30000ms fetch window to run, so review may not consider pipeline-failure results for inline comments if any failures occurred after the fetch window. Increase the timeout if you want to wait longer or run a Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/reports/snyk_vulnerabilities_remediation_report.md`:
- Around line 8-13: Update the pytest remediation entry to state the vulnerable
range precisely (vulnerable through 9.0.2 / CVE-2025-71176 affecting
TOCTOU/insecure temp dir handling) and clarify the compatibility claim: change
the sentence about "no breaking changes" to note that 9.0.3 is a bugfix release
with no breaking changes itself, but the upgrade path from 8.x crosses 9.0.0
which introduced breaking changes—so either confirm project compatibility via
testing or explicitly limit the claim to "pytest 9.0.3 contains no breaking
changes relative to 9.0.0" and recommend testing before upgrading from 8.1.1;
update the pytest section header and the "Ação Tomada" text accordingly.
- Around line 20-27: Update the report for the md2pdf upgrade to include
concrete evidence tying v3.1.1 to the claimed CVE and dependency upgrades: fetch
and cite md2pdf v3.1.1 release notes or changelog and the package
metadata/lockfile (pyproject.lock/poetry.lock/requirements.txt or setup.py)
showing the actual resolved versions of WeasyPrint, markdown2 and Pillow; verify
and state that the public API call pattern (e.g., md2pdf(pdf_path,
md_file_path=...)) remains compatible with 3.1.1 by referencing the changelog or
simple usage example from the release, and explicitly reconcile whether Pillow’s
flagged issue is still present by listing its resolved version or remaining
vulnerability status.
- Around line 14-19: Update the python-dotenv entry to clarify that
CVE-2026-28684 affects write/edit operations (functions that rewrite .env such
as set_key/unset_key) and not read-only usage via load_dotenv; state that this
repo pins python-dotenv==1.2.2 in requirements.txt and that a code search shows
no usages of set_key or unset_key so the vulnerability is not applicable for
read-only loading, and add a note to verify/mention the absence of
set_key/unset_key calls in the codebase.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 41684a46-265d-4c25-bac2-18ea2fbf38e6
📒 Files selected for processing (2)
docs/reports/snyk_vulnerabilities_remediation_report.mdrequirements.txt
| ### 1. `pytest` | ||
| - **Versão Anterior:** 8.1.1 | ||
| - **Vulnerabilidade:** CVE-2025-71176 (Uso inseguro de diretórios temporários, permitindo DoS local ou escalonamento de privilégios). | ||
| - **Versão Atualizada:** 9.0.3 | ||
| - **Ação Tomada:** Atualização da versão para mitigar a vulnerabilidade. | ||
|
|
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
CVE-2025-71176 pytest temporary directory vulnerability
💡 Result:
CVE-2025-71176 is a security vulnerability in the pytest framework affecting versions up to and including 9.0.2 [1][2][3]. The vulnerability stems from pytest's use of a predictable naming pattern, /tmp/pytest-of-{user}, for its base temporary directory on UNIX systems [2][4][5]. Because this directory name is predictable, it is susceptible to local symlink attacks and Time-of-Check to Time-of-Use (TOCTOU) race conditions [6][4][5]. An attacker on a multi-user system could pre-create a malicious symlink or directory at that path, potentially leading to denial of service, unauthorized file access, or privilege escalation [1][2][5]. This issue was addressed in the pytest repository through two primary efforts: 1. A comprehensive fix (PR #14279) introduced the use of randomly-named root directories generated via tempfile.mkdtemp, eliminating the predictable path entirely, and implemented file-descriptor-based ownership checks to prevent TOCTOU races [6]. 2. A simpler, backportable fix (PR #14343) was merged to explicitly stop following symlinks and reject them if they are detected at the base temporary path, providing a remediation that was easier to include in maintenance releases [7][8][9]. Users are advised to upgrade to pytest 9.0.3 or later to remediate this vulnerability [1][10]. As a temporary mitigation, administrators on affected systems can rely on kernel-level protections (such as setting fs.protected_symlinks = 1 on Linux) or manually define a secure temporary directory using environment variables like PYTEST_DEBUG_TEMPROOT [10][4][5].
Citations:
- 1: https://osv.dev/vulnerability/GHSA-6w46-j5rx-g56g
- 2: https://osv.dev/vulnerability/CVE-2025-71176
- 3: GHSA-6w46-j5rx-g56g
- 4: https://www.openwall.com/lists/oss-security/2026/01/21/5
- 5: Vulnerable tmpdir handling (CVE-2025-71176) pytest-dev/pytest#13669
- 6: tmpdir: prevent symlink attacks and TOCTOU races (CVE-2025-71176) pytest-dev/pytest#14279
- 7: tmpdir: fix insecure temporary directory vulnerability (CVE-2025-71176) pytest-dev/pytest#14343
- 8: pytest-dev/pytest@95d8423
- 9: pytest-dev/pytest@ddee02a
- 10: https://security-tracker.debian.org/tracker/CVE-2025-71176
🌐 Web query:
pytest 9.0.3 release notes breaking changes
💡 Result:
Pytest 9.0.3, released on April 7, 2026, is a bug-fix release designed as a drop-in replacement [1][2][3]. It contains no breaking changes [1]. While it does not introduce breaking changes, it does include one notable behavior change regarding plugin loading: Blocking a conftest.py file using the -p no: option is now explicitly disallowed [4][3]. Previously, this action could cause an internal assertion failure during plugin loading. Pytest 9.0.3 now raises a clear UsageError, explaining that conftest files are not plugins and cannot be disabled via the -p flag [4][3]. Additionally, this release includes a fix for an insecure temporary directory issue (CVE-2025-71176) [4][3]. If you are looking for breaking changes in the 9.x release cycle, those were primarily introduced in pytest 9.0.0, which included drops in Python 3.9 support, changes to how overlapping test arguments are handled, and making PytestRemovedIn9Warning deprecation warnings errors by default [5][6][7].
Citations:
- 1: https://docs.pytest.org/en/stable/announce/release-9.0.3.html
- 2: https://pytest.org/en/stable/changelog.html
- 3: https://github.com/pytest-dev/pytest/releases
- 4: https://docs.pytest.org/en/9.0.x/changelog.html
- 5: https://github.com/pytest-dev/pytest/releases/tag/9.0.0
- 6: https://pytest.org/en/latest/changelog.html
- 7: https://docs.pytest.org/en/stable/changelog.html?featured_on=pythonbytes
Fix/clarify pytest remediation entry (CVE + compatibility)
CVE-2025-71176is correctly attributed topytestand covers insecure/TOCTOU-prone temporary directory handling on UNIX (symlink/race issues); the vulnerable range is up to and including9.0.2, so upgrading8.1.1 → 9.0.3is an appropriate fix.pytest 9.0.3is a drop-in bugfix release with no breaking changes, but the8.x → 9.xupgrade crosses9.0.0, which introduced breaking changes; the report should either cite tested compatibility for the project or explicitly limit the compatibility claim to “9.0.3 has no breaking changes.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/reports/snyk_vulnerabilities_remediation_report.md` around lines 8 - 13,
Update the pytest remediation entry to state the vulnerable range precisely
(vulnerable through 9.0.2 / CVE-2025-71176 affecting TOCTOU/insecure temp dir
handling) and clarify the compatibility claim: change the sentence about "no
breaking changes" to note that 9.0.3 is a bugfix release with no breaking
changes itself, but the upgrade path from 8.x crosses 9.0.0 which introduced
breaking changes—so either confirm project compatibility via testing or
explicitly limit the claim to "pytest 9.0.3 contains no breaking changes
relative to 9.0.0" and recommend testing before upgrading from 8.1.1; update the
pytest section header and the "Ação Tomada" text accordingly.
| ### 3. `md2pdf` | ||
| - **Versão Anterior:** 1.0.1 | ||
| - **Vulnerabilidade:** Vulnerabilidades transitivas através de dependências defasadas: | ||
| - **WeasyPrint** (CVE-2025-68616): Falha de Server-Side Request Forgery (SSRF) permitindo que requisições bypassassem políticas de segurança. | ||
| - **markdown2**: Múltiplas vulnerabilidades de Cross-Site Scripting (XSS). | ||
| - **Versão Atualizada:** 3.1.1 | ||
| - **Ação Tomada:** A versão 1.0.1 do `md2pdf` não possuía travas atualizadas para dependências seguras. A atualização para a versão 3.1.1 garantiu a utilização de versões modernas e seguras do WeasyPrint e do markdown2. | ||
|
|
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
md2pdf 3.1.1 changelog breaking changes API
💡 Result:
md2pdf v3.1.1 (jmaupetit/md2pdf) has no breaking changes to its API documented in the 3.1.1 changelog; it only contains a security fix. The upstream changelog shows 3.1.1 dated 2026-03-31 under “Security” with the entry “Upgrade pygments to 2.20+” and does not list any “Changed/Removed” items or any notes labeled as breaking/API changes for 3.1.1 [1]. For context, the changelog and releases do record breaking changes, but they are associated with version 3.0.0 (not 3.1.1). In the releases page, v3.0.0 includes “[BC]” items such as switching to Typer and “CLI: moved to a no-arguments command (only options)” and “Add dependency groups to handle project flavors (cli and latex) [BC]” [2].
Citations:
- 1: https://github.com/jmaupetit/md2pdf/blob/main/CHANGELOG.md
- 2: https://github.com/jmaupetit/md2pdf/releases
🏁 Script executed:
#!/bin/bash
# Test md2pdf 3.1.1 API compatibility with existing usage pattern
python3 -m venv /tmp/test_md2pdf_api
source /tmp/test_md2pdf_api/bin/activate
pip install --quiet md2pdf==3.1.1
# Test if the API signature still works
python3 << 'PYEOF'
try:
from md2pdf.core import md2pdf
import inspect
sig = inspect.signature(md2pdf)
print(f"✓ md2pdf.core.md2pdf signature: {sig}")
params = list(sig.parameters.keys())
if 'pdf_file_path' in params or 'md_file_path' in params:
print("✓ Expected parameters found")
else:
print(f"⚠ Parameters changed: {params}")
except ImportError as e:
print(f"✗ Import failed: {e}")
except Exception as e:
print(f"✗ Error: {e}")
PYEOF
deactivate
rm -rf /tmp/test_md2pdf_apiRepository: portosoft/ksc-deployment-runbook
Length of output: 1828
md2pdf 1.0.1 → 3.1.1: API-safe, but CVE/dependency remediation claims need evidence
- Upstream md2pdf v3.1.1 changelog shows no breaking/API-breaking changes for 3.1.1 (breaking items are associated with 3.0.0), so the existing call style like
md2pdf(pdf_path, md_file_path=...)is unlikely to break due to this upgrade. - The report’s claim that md2pdf 3.1.1 fixes WeasyPrint CVE-2025-68616 (SSRF) and pulls in “secure versions” of WeasyPrint/markdown2 (and Pillow) is not evidenced by the gathered results; add concrete proof by tying md2pdf 3.1.1’s resolved dependency versions to the CVE fix (and reconcile with the already-flagged Pillow issue).
🧰 Tools
🪛 LanguageTool
[style] ~22-~22: Para conferir mais clareza ao seu texto, busque usar uma linguagem mais concisa.
Context: ...ilidade:** Vulnerabilidades transitivas através de dependências defasadas: - **WeasyPrin...
(ATRAVES_DE_POR_VIA)
[locale-violation] ~23-~23: “Server” é um estrangeirismo. É preferível dizer “servidor”.
Context: ...WeasyPrint** (CVE-2025-68616): Falha de Server-Side Request Forgery (SSRF) permitindo ...
(PT_BARBARISMS_REPLACE_SERVER)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/reports/snyk_vulnerabilities_remediation_report.md` around lines 20 -
27, Update the report for the md2pdf upgrade to include concrete evidence tying
v3.1.1 to the claimed CVE and dependency upgrades: fetch and cite md2pdf v3.1.1
release notes or changelog and the package metadata/lockfile
(pyproject.lock/poetry.lock/requirements.txt or setup.py) showing the actual
resolved versions of WeasyPrint, markdown2 and Pillow; verify and state that the
public API call pattern (e.g., md2pdf(pdf_path, md_file_path=...)) remains
compatible with 3.1.1 by referencing the changelog or simple usage example from
the release, and explicitly reconcile whether Pillow’s flagged issue is still
present by listing its resolved version or remaining vulnerability status.
…rabilities This commit addresses PR #27 failures by bumping versions to mitigate CVE-2025-71176, CVE-2026-28684, and transitive CVE-2025-68616 (WeasyPrint) & XSS in markdown2. Added a remediation report in docs/reports/
There was a problem hiding this comment.
♻️ Duplicate comments (1)
docs/reports/snyk_vulnerabilities_remediation_report.md (1)
26-26:⚠️ Potential issue | 🟠 Major | ⚡ Quick winDo not assert Pillow remediation without resolved-version evidence.
The sentence claiming Pillow vulnerabilities were resolved is still not substantiated by dependency-resolution evidence in this PR context, while static analysis continues to flag critical Pillow findings. Please either (a) add concrete resolved versions/proof from lock/dependency metadata, or (b) soften this to a verification statement instead of a definitive remediation claim.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/reports/snyk_vulnerabilities_remediation_report.md` at line 26, The remediation statement in the "Ação Tomada" paragraph asserts that Pillow vulnerabilities were resolved without providing dependency-resolution evidence; either update that paragraph to include concrete resolved versions and proof (e.g., add the Pillow resolved version and a reference to the lockfile/poetry.lock / pipfile.lock metadata showing the resolved tree for md2pdf v3.1.1) or change the phrasing to a verification-style statement (e.g., "checks indicate the upgrade should address known Pillow issues; see lockfile for resolved versions") — edit the sentence that currently mentions Pillow and md2pdf v3.1.1 accordingly to include the chosen proof or to soften the claim.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@docs/reports/snyk_vulnerabilities_remediation_report.md`:
- Line 26: The remediation statement in the "Ação Tomada" paragraph asserts that
Pillow vulnerabilities were resolved without providing dependency-resolution
evidence; either update that paragraph to include concrete resolved versions and
proof (e.g., add the Pillow resolved version and a reference to the
lockfile/poetry.lock / pipfile.lock metadata showing the resolved tree for
md2pdf v3.1.1) or change the phrasing to a verification-style statement (e.g.,
"checks indicate the upgrade should address known Pillow issues; see lockfile
for resolved versions") — edit the sentence that currently mentions Pillow and
md2pdf v3.1.1 accordingly to include the chosen proof or to soften the claim.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 0865baf1-bea4-414b-bd28-99ec022ff2b9
📒 Files selected for processing (2)
docs/reports/snyk_vulnerabilities_remediation_report.mdrequirements.txt
fix(deps): update python-dotenv, pytest, and md2pdf to fix snyk vulne…
1 participant
…rabilities
This commit addresses PR #27 failures by bumping versions to mitigate CVE-2025-71176, CVE-2026-28684, and transitive CVE-2025-68616 (WeasyPrint) & XSS in markdown2.
Added a remediation report in docs/reports/
PR Template
Tipo de Mudança
Descrição
Descreva brevemente o que este PR faz.
Como foi testado?
ksc_audit.py.Checklist
Summary by CodeRabbit
Documentation
Chores