fix(deps): refresh uv.lock to clear 72 known vulnerabilities by williaby · Pull Request #79 · ByronWilliamsCPA/audio-processor

williaby · 2026-09-03T11:59:03Z

Why

Three of the four required status checks fail on main, and all three trace
to one step: Dependency vulnerability scan (pip-audit) inside the org
reusable python-ci.yml, plus the equivalent OSV Scanner step in
security-analysis.yml.

The locked dependency set carries 92 pip-audit findings across 15 packages
(OSV counts 72: 2 Critical, 45 High, 23 Medium, 1 Low, 1 Unknown). Every
dependent gate then goes red:

Required context	How it fails
`CI Gate`	`ci.yml` job `gate` needs `ci` -> `CI Pipeline / Code Quality Checks` -> pip-audit step exits 1
`Dependency & Standards Validation`	`pr-validation.yml` job `validation-summary` needs `core-validation` -> same reusable, same step
`Security Gate Validation`	`security-analysis.yml` -> `OSV Vulnerability Scanner` exits 1 on the same lockfile
`Check REUSE Compliance`	already green, untouched

Nothing in this repo's own source is at fault. Ruff format reports
49 files already formatted and Ruff lint reports All checks passed on the
unmodified tree, so this is not the fleet-wide ruff-drift pattern.

What changed

uv.lock only. Targeted uv lock --upgrade-package for exactly the 15
flagged packages rather than a blanket uv lock --upgrade, so the resolver
is not free to drift ruff, pytest, or the rest of the toolchain and reformat
the tree underneath the quality gate.

Notable moves: cryptography 48.0.0 -> 50.0.1, starlette 1.2.1 -> 1.6.0,
torch 2.12.0 -> 2.14.0, gitpython 3.1.50 -> 3.1.61,
pymdown-extensions 10.21.3 -> 11.0.2.

Verification (local, repo's own pinned toolchain)

Command	Result
`uv run --frozen pip-audit --ignore-vuln PYSEC-2022-42969 --ignore-vuln PYSEC-2026-139`	No known vulnerabilities found
`osv-scanner scan source --lockfile=uv.lock`	No issues found, exit 0
same, against the pre-change lock	15 packages, 72 vulnerabilities, exit 1
`uv run --frozen ruff format --check src/ tests/`	49 files already formatted
`uv run --frozen ruff check src/ tests/`	All checks passed
`uv run --frozen pytest`	475 passed, coverage 93.33% (gate 80%)
`uv run --frozen basedpyright src/`	1 error, byte-identical to pre-change (pre-existing numpy dtype variance at `vad_processor.py:310`)

Notes for reviewers

Pattern B duplication is present but not the cause. ci.yml (job
CI Pipeline) and pr-validation.yml (job Core Validation) both call the
same org reusable python-ci.yml, so Code Quality Checks appears twice in
the rollup. Both instances fail for the same reason and both go green with
this fix. This PR deliberately does not remove the duplicate: the
required Dependency & Standards Validation job depends on
core-validation, so deleting either caller would drop a required context.
Deduplicating is a separate, deliberate change.
osv-scanner.toml and [tool.pip-audit] ignore-vuln now list ignores that
no longer match anything (CVE-2022-42969, PYSEC-2022-42969,
PYSEC-2026-139, GHSA-w596-4wvx-j9j6). OSV reports them as
unused ignores but still exits 0, so this PR leaves them alone rather than
widening the diff. Worth a follow-up cleanup alongside
docs/known-vulnerabilities.md.
pre-commit run --all-files has two pre-existing failures unrelated to this
change: the BasedPyright error above, and validate-front-matter on
docs/audit/2026-05-29/*.md (redundant H1 headings). Neither is a required
status check.

Generated with Claude Code

pip-audit and OSV Scanner both fail on the default branch because the locked dependency set carries 92 pip-audit findings across 15 packages (72 OSV findings: 2 Critical, 45 High, 23 Medium). Those failures take down every required status check that depends on them: - CI Gate (via CI Pipeline / Code Quality Checks, step "Dependency vulnerability scan") - Dependency & Standards Validation (via Core Validation, same step) - Security Gate Validation (via Security Analysis / OSV Vulnerability Scanner, which exits 1 on any unignored finding) Targeted `uv lock --upgrade-package` for exactly the 15 flagged packages rather than a blanket `uv lock --upgrade`, so the resolver is not free to drift ruff, pytest, or the rest of the toolchain and reformat the tree. Verified locally against the repo's own pinned toolchain: - uv run --frozen pip-audit ... -> No known vulnerabilities found - osv-scanner scan source --lockfile=uv.lock -> No issues found (exit 0) (same lock before the change: 15 packages, 72 vulnerabilities, exit 1) - uv run --frozen ruff format --check src/ tests/ -> 49 files already formatted - uv run --frozen ruff check src/ tests/ -> All checks passed - uv run --frozen pytest -> 475 passed, coverage 93.33% (gate 80%) - uv run --frozen basedpyright src/ -> 1 error, unchanged from before this commit (pre-existing numpy dtype variance in vad_processor.py) Notable version moves: cryptography 48.0.0 -> 50.0.1, starlette 1.2.1 -> 1.6.0, torch 2.12.0 -> 2.14.0, gitpython 3.1.50 -> 3.1.61, pymdown-extensions 10.21.3 -> 11.0.2. #ASSUME torch 2.14.0 and torchvision 0.29.0 keep the CUDA 13 wheel layout the [ml] extra resolves today; the full suite passes locally on CPU wheels only. #VERIFY watch the first GPU-path run after merge. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Copilot

Copilot wasn't able to review any files in this pull request.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

coderabbitai · 2026-09-03T11:59:11Z

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

uv.lock is excluded by !**/*.lock, !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: cbf3f16e-94b5-4238-8aea-b2d986df0a1d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

socket-security · 2026-09-03T11:59:28Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability
torch@2.12.0 ⏵ 2.14.0		⁺¹
torchvision@0.27.0 ⏵ 0.29.0	⁺¹
pydantic-settings@2.14.1 ⏵ 2.15.0	⁺¹	⁺²

View full report

github-actions · 2026-09-03T12:00:04Z

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

pip/cryptography

50.0.1

Unknown

pip/cuda-toolkit

13.0.3.0

Unknown

pip/gitpython

3.1.61

🟢 7.2

Details

Check	Score	Reason
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Code-Review	⚠️ 1	Found 2/11 approved changesets -- score normalized to 1
Maintained	🟢 10	30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	🟢 10	project is fuzzed
License	🟢 10	license file detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches
SAST	🟢 10	SAST tool is run on all commits

pip/jupyter-builder

1.2.2

Unknown

pip/jupyter-server

2.21.0

Unknown

pip/jupyterlab

4.6.3

Unknown

pip/mistune

3.3.4

Unknown

pip/msgpack

1.2.2

Unknown

pip/notebook

7.6.2

Unknown

pip/nvidia-cudnn-cu13

9.24.0.43

Unknown

pip/nvidia-nccl-cu13

2.30.7

Unknown

pip/pillow

12.3.0

Unknown

pip/pip

26.2.1

Unknown

pip/pyasn1

0.6.4

Unknown

pip/pydantic-settings

2.15.0

Unknown

pip/pymdown-extensions

11.0.2

Unknown

pip/setuptools

84.0.0

Unknown

pip/starlette

1.6.0

Unknown

pip/torch

2.14.0

Unknown

pip/torchvision

0.29.0

🟢 5.4

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 9	Found 27/30 approved changesets -- score normalized to 9
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 2	branch protection is not maximal on development and all release branches
SAST	🟢 7	SAST tool is not run on all commits -- score normalized to 7

pip/tornado

6.5.8

Unknown

pip/triton

3.8.0

Unknown

Scanned Files

uv.lock

sonarqubecloud · 2026-09-03T12:02:01Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Relocks uv.lock to resolve stale-dependency CVEs surfaced by the Dependency & Standards Validation pip-audit gate and the OSV Vulnerability Scanner, matching the fix already applied on PR #79 in this repo. Also fixes the real Code Quality Checks failures the relock's ruff 0.15.16 -> 0.16.5 bump uncovered, not suppressions: - vad_processor.py: basedpyright strict flagged process_audio()'s speech_chunks.append(chunk) because sf.read(dtype="float64")'s stub returns a dtype union for a non-literal dtype argument. dtype="float64" guarantees a float64 array at runtime, so cast the loaded audio to the module's AudioSamples alias once, right after loading. - api/__init__.py: RUF LOG004 flagged logger.exception() in global_exception_handler because it runs outside a lexical except block (FastAPI calls it with the exception instance, not via re-raise), so the implicit sys.exc_info() lookup is not reliable there. Switched to logger.error(..., exc_info=exc), which passes the exception explicitly and keeps full traceback logging. - api/routes.py: PLR0917 flagged process_audio()'s 6 positional parameters. FastAPI always invokes route handlers via dependant.call(**values), so making the Form/File parameters keyword-only is a safe, non-breaking fix. - core/exceptions.py: RUF036 flagged None in the middle of the ErrorDetails union; moved it to the end. - core/sentry.py: PLR0917 flagged init_sentry()'s 8 positional parameters. Every call site (including tests/unit/test_sentry.py) already uses keyword arguments, so making all parameters keyword-only is a safe, non-breaking fix. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

williaby · 2026-09-03T16:39:34Z

Closing as superseded by #78, which merged first and already carried the uv.lock relock into main.

Verification performed against main at f5a8bb7 (the #78 merge commit):

uv sync --all-extras --frozen then uv run --frozen pip-audit --skip-editable --ignore-vuln PYSEC-2022-42969 --ignore-vuln PYSEC-2026-139 reports: No known vulnerabilities found.
gh api repos/ByronWilliamsCPA/audio-processor/pulls/78/files confirms fix(ci): emit bare Security Gate Validation context #78's diff includes uv.lock alongside its Security Gate Validation fix.
The most recent CI run on main (f5a8bb7) shows CI, Security Analysis, SonarCloud, and REUSE Compliance all success.

Since #78 already resolved the same 92-finding/15-package pip-audit backlog this PR targeted, and the branch is now DIRTY against main, closing rather than rebasing.

Copilot AI lite review requested due to automatic review settings September 3, 2026 11:59

Copilot AI reviewed Sep 3, 2026

View reviewed changes

williaby enabled auto-merge September 3, 2026 12:29

williaby closed this Sep 3, 2026

auto-merge was automatically disabled September 3, 2026 16:39
Pull request was closed

Navigation Menu

Uh oh!

Uh oh!

fix(deps): refresh uv.lock to clear 72 known vulnerabilities - #79

fix(deps): refresh uv.lock to clear 72 known vulnerabilities#79
williaby wants to merge 1 commit into
mainfrom
claude/fix-default-branch-ci-0

williaby commented Sep 3, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

coderabbitai Bot commented Sep 3, 2026

Review skipped

Uh oh!

socket-security Bot commented Sep 3, 2026

Uh oh!

github-actions Bot commented Sep 3, 2026

Uh oh!

sonarqubecloud Bot commented Sep 3, 2026

Uh oh!

williaby commented Sep 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

williaby commented Sep 3, 2026

Why

What changed

Verification (local, repo's own pinned toolchain)

Notes for reviewers

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot commented Sep 3, 2026

Review skipped

Uh oh!

socket-security Bot commented Sep 3, 2026

Uh oh!

github-actions Bot commented Sep 3, 2026

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

sonarqubecloud Bot commented Sep 3, 2026

Quality Gate passed

Uh oh!

williaby commented Sep 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants