Daily security sweep — backlog

[benfrank241]

Running backlog from the daily security sweep. Items here are not blocking PRs — they are things the sweep found and could not safely fix inside a security-only bundle.

---

2026-09-02 — python-api unit tests are broken on main (pre-existing)

Found while establishing a verification baseline for #2.

Repo: vectorize-iris · Path: python-api · Step: uv run pytest

Result on unmodified main (no dependency changes at all):

10 failed, 9 passed, 10 skipped

Exact signature:

E   AttributeError: module 'vectorize_iris' has no attribute 'requests'
.../unittest/mock.py:1451: in __enter__
    self.target = self.getter()
.../pkgutil.py:528: in resolve_name
    result = getattr(result, p)

Failing tests:

tests/test_async_client.py::TestExtractTextAsync::test_file_not_found
tests/test_async_client.py::TestExtractTextAsync::test_successful_extraction
tests/test_async_client.py::TestExtractTextAsync::test_extraction_failure
tests/test_vectorize_iris.py::TestExtractText::test_file_not_found
tests/test_vectorize_iris.py::TestExtractText::test_successful_extraction
tests/test_vectorize_iris.py::TestExtractText::test_upload_failure
tests/test_vectorize_iris.py::TestExtractText::test_file_upload_failure
tests/test_vectorize_iris.py::TestExtractText::test_extraction_failure
tests/test_vectorize_iris.py::TestExtractText::test_extraction_timeout
tests/test_vectorize_iris.py::TestExtractText::test_custom_credentials

Cause: the tests mock.patch("vectorize_iris.requests…"), but the package never re-exports requests / aiohttp at top level, so mock cannot resolve the target. This is a test-authoring issue, not a dependency issue — the patch targets should be the module that actually imports them (e.g. vectorize_iris.client.requests, vectorize_iris.async_client.aiohttp).

Why it went unnoticed: .github/workflows/ci.yml job test-python is named "Test Python API" but only runs:

- name: Build Python package
  run: |
    cd python-api
    python -m build

It never invokes pytest. Worth adding uv sync && uv run pytest to that job once the suite is green, otherwise this rots again.

Deliberately not fixed in #2 to keep that bundle a pure security change.

---

2026-09-02 — fallback if requires-python >= 3.10 is rejected in #2

Every fix version for the flagged packages needs Python >= 3.10, so #2 raises requires-python. If maintainers must keep 3.8/3.9 support, the fallback is a lock-only scoped upgrade, which leaves these 59 GHSA occurrences unfixed on the legacy fork branches:

pin (legacy fork)	remaining GHSA
aiohttp==3.10.11	33
aiohttp==3.13.5	14
urllib3==2.2.3	6
urllib3==2.6.3	2 (incl. GHSA-mf9v-mfxr-j63j)
pytest==8.3.5 / 8.4.2	1 each
requests==2.32.4 / 2.32.5	1 each

---

2026-09-02 — Dependabot alerts are not scanning this repo

/repos/vectorize-io/vectorize-iris/dependabot/alerts returns HTTP 200 with an empty array for all four states (open, fixed, dismissed, auto_dismissed) — never a single alert recorded, despite python-api/uv.lock carrying 43 real advisories. That is "enabled endpoint, never scanned", not "clean".

Recommend enabling Dependabot alerts under Settings → Code security. Until then this repo can only be swept via local OSV/pip-audit runs, and dedupe has to key on GHSA ids and branch names rather than alert numbers.

Also note nodejs-api/ and rust-cli/ ship no committed lockfile (package-lock.json / Cargo.lock), so neither Dependabot nor a local audit can pin down their dependency versions. CI runs a bare npm install for nodejs-api. Committing lockfiles would make both auditable.