Implementation Plan: Fix Dependabot Alerts — Bump fastmcp and dynaconf Pins

[Trecek]

Summary

Bump two direct dependency lower bounds in pyproject.toml to resolve 9 of 11 open Dependabot security alerts, then regenerate the lock file to pull transitive dependencies (PyJWT, Pygments) to safe versions, resolving the remaining 2 alerts. The changes are confined to pyproject.toml and uv.lock — no source code modifications are required.

Alerts resolved:

Alert	Severity	Package	Resolution
#11	CRITICAL	fastmcp (SSRF)	Direct pin bump
#2	CRITICAL	authlib (sig bypass)	Transitive via fastmcp
#10	HIGH	fastmcp (OAuth)	Direct pin bump
#3	HIGH	authlib (padding oracle)	Transitive via fastmcp
#4	HIGH	authlib (OIDC)	Transitive via fastmcp
#5	HIGH	dynaconf (RCE @Jinja)	Direct pin bump
#1	HIGH	PyJWT (crit header)	Lock refresh
#9	MEDIUM	fastmcp (cmd injection)	Direct pin bump
#12	MEDIUM	cryptography (buffer overflow)	Transitive via fastmcp
#7	LOW	cryptography (DNS)	Transitive via fastmcp
#8	LOW	Pygments (ReDoS)	Lock refresh (dismiss if unresolved)

Architecture Impact

Development Diagram

%%{init: {'flowchart': {'nodeSpacing': 50, 'rankSpacing': 60, 'curve': 'basis'}}}%%
flowchart TB
    %% CLASS DEFINITIONS %%
    classDef cli fill:#1a237e,stroke:#7986cb,stroke-width:2px,color:#fff;
    classDef stateNode fill:#004d40,stroke:#4db6ac,stroke-width:2px,color:#fff;
    classDef handler fill:#e65100,stroke:#ffb74d,stroke-width:2px,color:#fff;
    classDef phase fill:#6a1b9a,stroke:#ba68c8,stroke-width:2px,color:#fff;
    classDef output fill:#00695c,stroke:#4db6ac,stroke-width:2px,color:#fff;
    classDef detector fill:#b71c1c,stroke:#ef5350,stroke-width:2px,color:#fff;
    classDef terminal fill:#1a237e,stroke:#7986cb,stroke-width:2px,color:#fff;
    classDef newComponent fill:#2e7d32,stroke:#81c784,stroke-width:2px,color:#fff;

    %% ENTRY %%
    DEV([Developer Workstation])

    subgraph DepMgmt ["● DEPENDENCY MANAGEMENT (PR Focus)"]
        direction TB
        PYPROJECT["● pyproject.toml<br/>━━━━━━━━━━<br/>build-backend: hatchling<br/>requires-python: >=3.11<br/>fastmcp >=3.2.0,<4.0<br/>dynaconf >=3.2.13,<4.0<br/>+ 10 other runtime deps"]
        UVLOCK["● uv.lock<br/>━━━━━━━━━━<br/>~92 packages locked<br/>Regenerated after pin bump<br/>Resolves Dependabot alerts"]
        PYPROJECT -->|"uv lock"| UVLOCK
    end

    subgraph Build ["BUILD TOOLING"]
        direction TB
        HATCH["hatchling<br/>━━━━━━━━━━<br/>build-backend<br/>Packages src/autoskillit/<br/>Includes: hooks/, migrations/<br/>.claude-plugin/, .mcp.json"]
        TASKFILE["Taskfile.yml<br/>━━━━━━━━━━<br/>install-worktree<br/>install-dev<br/>sync-plugin-version<br/>check-docs"]
        UVLOCK -->|"uv pip install -e .[dev]"| TASKFILE
        PYPROJECT --> HATCH
    end

    subgraph Quality ["PRE-COMMIT QUALITY GATES"]
        direction LR
        FORMAT["ruff-format<br/>━━━━━━━━━━<br/>Auto-formats<br/>Python files"]
        LINT["ruff check --fix<br/>━━━━━━━━━━<br/>E, F, I, UP, TID251<br/>line-length: 99"]
        MYPY["mypy<br/>━━━━━━━━━━<br/>src/ --ignore-missing-imports<br/>No pyproject config"]
        UVCHECK["uv-lock-check<br/>━━━━━━━━━━<br/>uv lock --check<br/>Triggers on pyproject.toml<br/>or uv.lock changes"]
        SECRETS["gitleaks<br/>━━━━━━━━━━<br/>Secret scanning<br/>v8.30.0"]
        NOWRITE["no-generated-configs<br/>━━━━━━━━━━<br/>Blocks hooks.json +<br/>settings.json commits"]
        FORMAT --> LINT --> MYPY
    end

    subgraph LayerCheck ["IMPORT LAYER ENFORCEMENT"]
        direction TB
        IMPORTLINT["import-linter<br/>━━━━━━━━━━<br/>7 layered contracts<br/>L0→L1→L2→L3<br/>Runs before pytest"]
    end

    subgraph Testing ["TEST FRAMEWORK"]
        direction TB
        PYTEST["pytest + pytest-asyncio<br/>━━━━━━━━━━<br/>asyncio_mode: auto<br/>timeout: 60s<br/>testpaths: tests/"]
        XDIST["pytest-xdist<br/>━━━━━━━━━━<br/>-n 4 parallel workers<br/>All tests parallelism-safe"]
        SMOKE["pytest -m smoke<br/>━━━━━━━━━━<br/>E2E tests<br/>Requires ANTHROPIC_API_KEY"]
        PYTEST --> XDIST
        PYTEST --> SMOKE
    end

    subgraph Tasks ["TASK RUNNER (test targets)"]
        direction LR
        TESTALL["task test-all<br/>━━━━━━━━━━<br/>lint-imports + pytest<br/>Human-facing"]
        TESTCHECK["task test-check<br/>━━━━━━━━━━<br/>TEST_RESULT=PASS/FAIL<br/>Automation/MCP"]
    end

    subgraph EntryPoints ["ENTRY POINTS"]
        EP["autoskillit<br/>━━━━━━━━━━<br/>autoskillit.cli:main<br/>serve / init / config<br/>skills / recipes / doctor"]
    end

    %% FLOW %%
    DEV --> PYPROJECT
    PYPROJECT --> UVCHECK
    UVLOCK --> UVCHECK
    MYPY --> IMPORTLINT
    IMPORTLINT --> TESTALL
    IMPORTLINT --> TESTCHECK
    TESTALL --> PYTEST
    TESTCHECK --> PYTEST
    HATCH --> EP
    DEV -->|"git commit triggers"| FORMAT
    DEV -->|"git commit triggers"| UVCHECK
    DEV -->|"git commit triggers"| SECRETS
    DEV -->|"git commit triggers"| NOWRITE

    %% CLASS ASSIGNMENTS %%
    class PYPROJECT,UVLOCK stateNode;
    class HATCH,TASKFILE phase;
    class FORMAT,LINT,MYPY,UVCHECK,SECRETS,NOWRITE detector;
    class IMPORTLINT detector;
    class PYTEST,XDIST,SMOKE handler;
    class TESTALL,TESTCHECK phase;
    class EP output;
    class DEV terminal;

Loading

Closes #698

Implementation Plan

Plan file: .autoskillit/temp/make-plan/fix-dependabot-alerts-bump-fastmcp-and-dynaconf-pins_plan_2026-04-09_201600.md

🤖 Generated with Claude Code via AutoSkillit

Token Usage Summary

Step	uncached	output	cache_read	cache_write	count	time
plan	1.4k	8.8k	763.7k	43.9k	1	4m 16s
verify	28	5.6k	307.9k	28.1k	1	1m 44s
implement	166	10.9k	722.2k	36.6k	1	3m 26s
prepare_pr	52	3.5k	140.7k	34.1k	1	1m 10s
run_arch_lenses	53	4.4k	152.9k	23.6k	1	2m 13s
compose_pr	59	4.6k	181.9k	22.4k	1	1m 20s
Total	1.7k	37.8k	2.3M	188.8k		14m 12s

[Trecek]

AutoSkillit PR Review — Verdict: needs_human

[Trecek]

[warning] defense: pygments>=2.20.0 has no upper bound. For a security-sensitive package being pinned as part of a Dependabot alert fix, an open-ended specifier allows future breaking or vulnerable versions to be pulled in automatically. Consider adding <3.0 to constrain to the current major.

[Trecek]

[warning] defense: pyjwt>=2.12.0 has no upper bound. pyjwt is a security-sensitive package (JWT validation); an open-ended specifier permits future major versions with breaking auth semantics to resolve silently. Consider adding <3.0 to constrain to the current major.

[Trecek]

AutoSkillit review: uncertain trade-offs detected. @Trecek Please review. See inline comments.