Refresh the fastapi C2-loop scan baseline entry for the current release - #7223
Conversation
…release The pip scan-packages studio shard is red on main and on every open PR: the baselined fastapi finding (the benign SSE keepalive `while True:` loop in fastapi/routing.py, reviewed and suppressed long ago) records its evidence at L586 with the span digest of the fastapi release current at baseline time. The latest fastapi shifts that loop to L587 and its span digest with it, so the evidence hash no longer matches and the scanner reports the finding as new, failing the shard with one unsuppressed CRITICAL. Re-reviewed the flagged code in the current release before refreshing: L587 is the same keepalive loop inside the streaming response machinery, not a beacon. Only the one entry's evidence and evidence_hash change. Verified with the scanner itself: `scan_packages.py fastapi --no-baseline` reproduces the exact CI evidence string, and with the updated baseline the same scan exits 0 with the finding suppressed as 1 CRITICAL baselined.
|
@codex review |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the baseline scan results in scripts/scan_packages_baseline.json to reflect a change in the line number (from L586 to L587) and the corresponding SHA256 hash/evidence hash for a critical check in fastapi/routing.py. There are no review comments, and I have no feedback to provide.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
|
Codex Review: Didn't find any major issues. What shall we delve into next? Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
…release (unslothai#7223) The pip scan-packages studio shard is red on main and on every open PR: the baselined fastapi finding (the benign SSE keepalive `while True:` loop in fastapi/routing.py, reviewed and suppressed long ago) records its evidence at L586 with the span digest of the fastapi release current at baseline time. The latest fastapi shifts that loop to L587 and its span digest with it, so the evidence hash no longer matches and the scanner reports the finding as new, failing the shard with one unsuppressed CRITICAL. Re-reviewed the flagged code in the current release before refreshing: L587 is the same keepalive loop inside the streaming response machinery, not a beacon. Only the one entry's evidence and evidence_hash change. Verified with the scanner itself: `scan_packages.py fastapi --no-baseline` reproduces the exact CI evidence string, and with the updated baseline the same scan exits 0 with the finding suppressed as 1 CRITICAL baselined.
1 participant
What
Refreshes the one stale entry in
scripts/scan_packages_baseline.jsonthat is failing thepip scan-packages :: studioshard on main and on every open PR.Why
The baseline suppresses a reviewed, benign finding: the SSE keepalive
while True:loop infastapi/routing.py, which the scanner's C2-loop heuristic flags. The entry pins the evidence at L586 together with the span digest of the fastapi release that was current when it was baselined. The latest fastapi release shifts the loop to L587 and changes the span digest, so the storedevidence_hashno longer matches and the scanner reports the finding as a new unsuppressed CRITICAL, turning the shard red (see the Security-audit runs on main, e.g. 29631733699 and 29621709961, bothstudio-scan=failureon an untouched baseline).Re-review of the flagged code
Before refreshing the suppression I re-read the flagged code in the current release: L587 of
fastapi/routing.pyis the same keepalive-comment loop inside the streaming response machinery as before (receive withanyio.fail_after, forward, emit a keepalive comment on timeout). It is not a polling beacon.Verification
python scripts/scan_packages.py fastapi --no-baselinereproduces the exact evidence string CI prints, including the L587 marker and span digest.1 finding(s) suppressed by baseline (1 CRITICAL, 0 HIGH, 0 MEDIUM).evidenceandevidence_hashfields (2 lines).