ci: clear pip-audit + npm-audit gate failures on redis bump branch (run #30307163631) - #139
Closed
Sbussiso wants to merge 2 commits into
Closed
ci: clear pip-audit + npm-audit gate failures on redis bump branch (run #30307163631)#139Sbussiso wants to merge 2 commits into
Sbussiso wants to merge 2 commits into
Conversation
added 2 commits
July 27, 2026 21:40
…ict) CI run #30306866673 (Test & Deploy) failed on the `Backend tests` → `Dependency scan (pip-audit)` step: Found 1 known vulnerability in 1 package Name Version ID Fix Versions click 8.3.1 PYSEC-2026-2132 8.3.3 `click` is a transitive dependency — pulled in by `uvicorn`, which depends on `click` with no version specifier, so uv resolved it to 8.3.1, the version flagged by: - PYSEC-2026-2132 / CVE-2026-7246 / GHSA-47fr-3ffg-hgmw - Command injection in click.edit(), fixed in 8.3.3 No app code calls click.edit() (CLI helper used by uvicorn's launcher), so the vulnerable path isn't reachable in this service — but pip-audit --strict is a deploy gate and correctly fails the scan. Fix: add `click>=8.3.3` to [tool.uv].constraint-dependencies in backend/pyproject.toml so the resolver floors the transitive click at a non-vulnerable version. uv re-locked click 8.3.1 -> 8.4.2. No top-level dependency change. Constraint is removable once uvicorn pins click>=8.3.3 itself (currently unbounded) or the advisory is withdrawn. Verified locally: $ cd backend && uv sync --extra dev && uv run pip-audit --strict Updated click v8.3.1 -> v8.4.2 No known vulnerabilities found This is the same click pin that draft PRs #116-#121 attempted on 2026-07-20 against dead ci-fix/* branches that never landed; click is still 8.3.1 on master, so the strict scan keeps failing. This PR targets master directly. --- Auto-triaged by Hermes coder from CI failure webhook (run #30306866673).
CI run #30307163631 (Test & Deploy) failed on the `Frontend audit + build` → `npm audit (production deps only, high+critical)` step: react-router 7.12.0 - 8.2.0 Severity: high React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response - GHSA-qwww-vcr4-c8h2 fix available via `npm audit fix --force` Will install react-router-dom@7.11.0, which is a breaking change Root cause: react-router 7.18.1 (pulled by react-router-dom@7.18.1, the latest published `dom` package) falls in the advisory's vulnerable range (>=7.12.0, <8.3.0). The advisory is RSC-mode specific — action execution before a 400 response in React Server Components mode. Why a waiver instead of a bump: - The app uses classic SPA routing: `<BrowserRouter>` + declarative `<Routes>`/`<Route>`. No `createBrowserRouter`, no `RouterProvider`, no `useFetcher`/`useActionData`/`useLoaderData`, no `<Form>`, no RSC/SSR/hydrateRoot. The vulnerable code path is NOT reachable. - No patched `react-router-dom` exists: 7.18.1 is the latest on the registry. The advisory's "patched >= 8.3.0" applies only to the bare `react-router` package — no `react-router-dom` 8.x has been published, so there is nothing safe to override up to. - npm's only suggested remediation is a breaking downgrade to react-router-dom@7.11.0, which loses 7.12→7.18 fixes and is riskier than the (unreachable) vuln. This mirrors the backend pip-audit convention documented in deploy.yml: "when a CVE shows up with no fix yet, add --ignore-vuln <ID> with a comment citing the upstream issue." npm v9 `audit` has no per-advisory --ignore flag, so the gate now runs `npm audit --json`, filters out the specifically-waived advisory slug (GHSA-qwww-vcr4-c8h2), and fails only on un-waived high+critical findings. Any OTHER high+critical advisory still blocks the deploy. Applied to both deploy.yml and weekly-deps-refresh.yml (which documents gate parity with deploy.yml). Remove the waiver once react-router-dom publishes a fixed 8.x (or a 7.x patch) and bump the pin in package.json. Verified locally: $ cd frontend && npm ci && npm audit --audit-level=high --omit=dev (with the waiver filter) → passes, 1 documented waiver active $ negative test (waive a non-existent ID) → correctly fails on the un-waived react-router advisory Auto-triaged by Hermes coder from CI failure webhook (run #30307163631).
Sbussiso
referenced
this pull request
Jul 27, 2026
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.10 to 8.5.23. - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.10...8.5.23) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.23 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CI failure triage — run #30307163631
The
Test & Deployworkflow failed on two unrelated audit gates when run against thedependabot/uv/backend/redis-8.0.1branch (the redis 7.4.0→8.0.1 bump, PR #71). Neither failure is caused by the redis change — both are pre-existing advisory-db findings that landed during a quiet week.Failing jobs / steps
click 8.3.1— PYSEC-2026-2132 / CVE-2026-7246 / GHSA-47fr-3ffg-hgmw (command injection inclick.edit(), fixed in 8.3.3)react-router 7.18.1— GHSA-qwww-vcr4-c8h2 (RSC Mode CSRF Bypass, high)Fix 1 — backend: pin
click>=8.3.3(commit 21e4714)clickis a transitive dep pulled in byuvicorn(which depends onclickwith no version specifier, so uv resolved it to 8.3.1). No app code callsclick.edit()— it's a CLI helper used by uvicorn's launcher — so the vulnerable path isn't reachable, butpip-audit --strictis a deploy gate and correctly fails the scan.Fix: add
click>=8.3.3to[tool.uv].constraint-dependenciesinbackend/pyproject.toml(same pattern as the existing authlib/urllib3/idna/starlette/pip/cryptography/joserfc/msgpack/pydantic-settings constraints). uv re-lockedclick 8.3.1 → 8.4.2. No top-level dependency change.Verified locally:
uv sync --extra dev→pip-audit --strict→ No known vulnerabilities found;ruff check→ All checks passed!;pytest -q→ 699 passed.Fix 2 — frontend: documented waiver for GHSA-qwww-vcr4-c8h2 (commit 8cf439c)
This advisory is RSC-mode specific (action execution before a 400 response in React Server Components mode). The app uses classic SPA routing:
<BrowserRouter>+ declarative<Routes>/<Route>. There is nocreateBrowserRouter, noRouterProvider, nouseFetcher/useActionData/useLoaderData, no<Form>, no RSC/SSR/hydrateRoot anywhere infrontend/src. The vulnerable code path is not reachable.A bump is not possible because no patched
react-router-domexists: 7.18.1 is the latest on the registry, and the advisory's "patched >= 8.3.0" applies only to the barereact-routerpackage — noreact-router-dom8.x has been published. npm's only suggested remediation is a breaking downgrade toreact-router-dom@7.11.0, which would lose 7.12→7.18 fixes and is riskier than the (unreachable) vuln.Fix: mirror the backend
pip-auditconvention documented indeploy.yml("when a CVE shows up with no fix yet, suppress the specific advisory with a citation"). npm v9audithas no per-advisory--ignoreflag, so the gate now runsnpm audit --json, filters out the waived advisory slug (GHSA-qwww-vcr4-c8h2), and fails only on un-waived high+critical findings. Any other high+critical advisory still blocks the deploy. Applied to bothdeploy.ymlandweekly-deps-refresh.yml(which documents gate parity).Verified locally: the waiver filter passes with only the react-router advisory present; a negative test (waiving a non-existent ID) correctly fails on the un-waived advisory.
vitest→ 85 passed;npm run build→ built in 380ms.Waiver removal
Remove the
GHSA-qwww-vcr4-c8h2waiver oncereact-router-dompublishes a fixed 8.x (or a 7.x patch) and bump the pin infrontend/package.json.Auto-triaged by Hermes coder from CI failure webhook (run #30307163631).