fix: the quickstart installed 1.4 (issue #188), and bump cryptography past a CVE - #194
Conversation
Issue #188 is someone unable to create an account on v1.4. The cause is the first-run setup-token bug — v1.4.4 has the token gate in deps.py and no token field in onboarding.html, so the owner account cannot be created at all — fixed months ago in v1.11.0. They got that version from us. docker-compose.yml pinned 1.4 while its own header said the images "track the `latest` tag", and told the reader to replace `:latest`, a string the file did not contain anywhere. Anyone checking whether they were current concluded they were. Both compose files now pin 1.11, and the header describes what the file actually does. A test asserts the pin equals the newest released major.minor rather than a fixed number, so this fails the next time it falls behind instead of quietly aging for seven minor versions. Also bumps cryptography to >=50.0.0 for the open Dependabot alert (high: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle). CashPilot uses Fernet, not PKCS#7 EnvelopedData, so the vulnerable path is not one we call — but the constraint allowed the vulnerable range and there is no reason to keep it. Verifying this took three attempts, which is worth recording. I first concluded v1.4 had no token gate at all, from `git show v1.4:... | grep -c` returning 0 — the tag is v1.4.4, `git show` produced NOTHING, and a count of zero on empty input reads exactly like a confirmed absence. The byte counts in the corrected check are there so a later reader can tell the two apart.
|
Warning Review limit reached
Next review available in: 43 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe Compose files now use CashPilot image series ChangesCompose release pinning
Cryptography version update
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pyproject.toml`:
- Line 31: Regenerate uv.lock from the updated cryptography>=50.0.0 requirement
so cashpilot’s locked dependency constraint and cryptography pin resolve to the
new floor. The affected declaration sites are pyproject.toml lines 31-31 and
requirements.txt lines 14-14; do not modify them unless needed for lockfile
generation.
In `@tests/test_compose_image_pins.py`:
- Around line 92-95: Update the pin assertion in the test around the live-image
parsing so it also evaluates the documented remote-worker template in
docker-compose.fleet.yml, rather than removing that commented image declaration.
Preserve the existing checks for active UI and co-located worker images while
ensuring the remote worker image pin is included.
- Around line 75-86: The _newest_series method currently uses pytest.skip when
no semver tags are found, but this is inappropriate in CI environments where git
is available—the issue is a configuration problem, not a missing Git
environment. Update the method to differentiate between two cases: when the git
command itself fails (indicating a non-Git environment, appropriate for
pytest.skip) versus when git succeeds but finds no matching tags (a
configuration issue requiring pytest.fail). Wrap the subprocess.run call in
try-except to catch command execution failures, then replace the current
pytest.skip at the end with pytest.fail to properly fail the test when git is
available but tags are unavailable.
- Around line 75-86: The _newest_series method currently relies on git's
creation date sorting which doesn't guarantee semantic version ordering,
allowing a later-created stale tag to be selected over a backfilled release tag.
Instead of using --sort=-creatordate and returning the first semver match,
collect all tags matching the semver pattern v(\d+)\.(\d+)\.(\d+), extract and
compare the MAJOR.MINOR versions across all matches, then return the maximum
semantic version found. This ensures the truly newest release by version number
is selected rather than by creation date.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 5388ac42-9a19-418f-8ae1-7091f404e107
📒 Files selected for processing (5)
docker-compose.fleet.ymldocker-compose.ymlpyproject.tomlrequirements.txttests/test_compose_image_pins.py
…ping in CI All three from CodeRabbit on this PR, all correct. The cryptography bump was INCOMPLETE. Dependabot's alert names uv.lock as the manifest, and the lock still declared >=48.0.1 and pinned cryptography 48.0.1 — inside the vulnerable range — so changing pyproject.toml and requirements.txt alone would have left the alert open while looking fixed. Regenerated with `uv lock --upgrade-package cryptography`: now 50.0.0, and the diff touches nothing else. The drift test would have SKIPPED in CI. actions/checkout does not fetch tags, so `git tag` returns nothing there and the test hit its own pytest.skip — decorative in the one place it is meant to run, which is the same shape of defect as the stale pin it guards. CI now fetches tags, and the test FAILS rather than skips when CI has none, so a regression in the workflow cannot quietly disarm it. The pin scan now includes commented lines. docker-compose.fleet.yml's commented remote-worker block is a template users uncomment and run, so a stale pin there ships an old image just as surely as a live one — and my first version stripped comments precisely to ignore it. Verified locally: cryptography 50.0.0 exists and installs cleanly; the suite ran against 48.0.0 here because this venv has no pip, while CI installs from requirements.txt and exercises 50.0.0. Negative control: planting a stale pin in the commented template now fails the test.
|
All three addressed — the first one mattered most. The CVE fix was incomplete. Dependabot names The drift test would have skipped in CI. The commented template is checked now. One thing I'll state plainly rather than imply: this venv has no |
tests/test_beads_batch_11.py is PR #193's work. A broad `git add -A tests/` swept it onto this branch, where the code it tests does not exist — so it failed here, and I pushed that. Scope check after removing it: this branch touches the two compose files, the cryptography constraint in pyproject/requirements, uv.lock, and the compose-pin test. Nothing else.
1 participant
Issue #188 is someone unable to create an account on v1.4. They got that version from us.
docker-compose.ymlpinned1.4while its own header claimed the images "track thelatesttag" and told the reader to replace:latest— a string the file did not contain anywhere. Anyone checking whether they were current concluded they were.The version that hands them:
So the owner account cannot be created at all. Fixed in v1.11.0, months ago.
What changed
1.11.cryptography>=50.0.0for the open Dependabot alert (high — PKCS#7 EnvelopedData Bleichenbacher oracle). We use Fernet, not PKCS#7 EnvelopedData, so the vulnerable path isn't one we call, but the constraint permitted the affected range.A verification failure worth flagging. I first concluded v1.4 had no token gate — from
git show v1.4:… | grep -creturning0. The tag isv1.4.4;git show v1.4:produced nothing, and a count of zero on empty input is indistinguishable from a confirmed absence. The corrected check prints byte counts alongside, so the two can be told apart. Had I not rechecked, I'd have told the reporter their problem was something else entirely.Verification: 2514 tests, 95.14% coverage, ruff clean. Negative control: restoring the
1.4pin fails the drift test.Summary by CodeRabbit