chore(deps): SOC 2 vulnerability bumps (fastmcp, authlib, urllib3, multipart, PyJWT, cryptography) - #8
Merged
Conversation
… cryptography Closes SOC 2 audit vulnerability findings flagged by Advantage Partners ahead of the 6/1/2026 observation window: - fastmcp >=3.2.0 closes CVE-2026-32871 (critical), CVE-2026-27124 (high) - authlib >=1.6.9 closes CVE-2026-27962 (critical), CVE-2026-28490, CVE-2026-28498, CVE-2026-28802 (high) - urllib3 >=2.7.0 closes CVE-2026-44432, CVE-2026-44431 (high) - python-multipart >=0.0.27 closes CVE-2026-24486, CVE-2026-42561 (high) - PyJWT >=2.12.0 closes CVE-2026-32597 (high) - cryptography >=46.0.5 (transitive requirement for authlib 1.6.9) pip-lupa CVE-2026-34444 is being handled separately via Vanta risk register acceptance — no upstream fix exists. Mirror PR will follow in sondera-ai/internal-cedar-python.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
am-sondera
approved these changes
May 31, 2026
ttran-sondera
approved these changes
May 31, 2026
mmaisel
approved these changes
Jun 3, 2026
mmaisel
enabled auto-merge (squash)
June 3, 2026 09:20
mmaisel
disabled auto-merge
June 3, 2026 09:21
mmaisel
enabled auto-merge (squash)
June 3, 2026 09:21
mmaisel
disabled auto-merge
June 3, 2026 09:23
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
Sondera's SOC 2 Type 2 observation window opens 6/1/2026. The auditor
(Advantage Partners) flagged the following vulnerability findings in
this repo. This PR closes them.
CVEs closed
Two of these (fastmcp and authlib) are CRITICAL severity and were
explicitly called out in the auditor's readiness review.
Out of scope for this PR
pip-lupaCVE-2026-34444 (CVSS 10.0): no upstream fix available.Being handled via Vanta risk register with documented mitigation.
Companion PR
A mirror PR in
sondera-ai/internal-cedar-pythonwill land alongsidethis one. Both repos publish to the same PyPI package name; keeping the
dependency declarations in lockstep prevents the internal twin from
republishing stale vulnerable deps.
Verification