fix(deps): refresh uv.lock to clear 91 known vulnerabilities by williaby · Pull Request #95 · ByronWilliamsCPA/rag-processor

williaby · 2026-09-03T11:41:47Z

Problem

Every open PR in this repo is BLOCKED, and the cause is on main, not in the PRs.

The org reusable python-ci.yml runs pip-audit as a hard gate (step 21,
"Dependency vulnerability scan", fail-on-security-findings defaults to true).
On main that step reported:

Found 91 known vulnerabilities in 14 packages

cryptography, gitpython, jupyter-server, jupyterlab, mistune, msgpack,
pillow, pip, pyasn1, pydantic-settings, pymdown-extensions, setuptools,
starlette, tornado.

That single step failure cascades:

Required context	Was	Cause
`CI Gate`	FAIL	`needs: [ci]`, and `CI Pipeline / Code Quality Checks` failed on pip-audit
`Dependency & Standards Validation`	FAIL	its own `pip-audit` step, same findings
`Security Gate Validation`	pass	not affected (see #94)
`Check REUSE Compliance`	pass

Validation Summary, CI Pipeline / CI Gate, and Core Validation / CI Gate
failed for the same reason.

Change

One file: uv.lock.

Targeted uv lock --upgrade-package <pkg> for each flagged package. No
pyproject.toml constraint was touched, and no direct dependency was added or
removed. setuptools dropped out of the graph naturally once the Jupyter
packages moved forward.

Package	From	To
cryptography	48.0.0	50.0.1
gitpython	3.1.50	3.1.61
jupyter-server	2.19.0	2.21.0
jupyterlab	4.5.8	4.6.3
mistune	3.2.1	3.3.4
msgpack	1.1.2	1.2.2
pillow	12.2.0	12.3.0
pip	26.1.2	26.2.1
pyasn1	0.6.3	0.6.4
pydantic-settings	2.14.1	2.15.0
pymdown-extensions	10.21.3	11.0.2
starlette	1.2.1	1.6.0
tornado	6.5.6	6.5.8

Verification (local, Python 3.12)

uv lock --check: clean
uv export --frozen --all-extras then pip-audit: No known vulnerabilities found
osv-scanner scan source --lockfile=uv.lock: No issues found, exit 0
uv run --frozen pytest: 496 passed, 1 skipped, 93.04% coverage (threshold 80%)
pre-commit run --files uv.lock: all hooks pass

Notes for reviewers

Supersedes the stale Renovate lock-file-maintenance PR chore(deps): Update #82 (last rebased 2026-06-29).
No # noqa, # type: ignore, continue-on-error, or ignore-list entry was used.
All 91 findings are genuinely resolved by version bumps.
Not related to fix(ci): add bare Security Gate Validation job #94 (bare Security Gate Validation job) or ci(security): remove GHAS-dependent CodeQL and dependency-review CI #93 (GHAS removal);
this PR touches only uv.lock and is file-disjoint from both.

Out of scope, reported not fixed

Duplicate CI. .github/workflows/ci.yml job ci and
.github/workflows/pr-validation.yml job core-validation both call the same
org python-ci.yml, so the entire Python CI suite runs twice per PR under two
prefixes (CI Pipeline / ... and Core Validation / ...). Only the ci.yml
caller feeds the required bare CI Gate. Deduplicating would halve CI cost but
needs a decision on validation-summary's needs: list, so it is left alone here.
Latent basedpyright errors. src/rag_processor/queue/redis_store.py lines
58, 105, 117, 182 report reportArgumentType on hset(mapping=...)
(dict[str, str] vs the invariant Mapping[FieldT, EncodableT]). These do not
block CI today because the org workflow wraps basedpyright in a
|| echo "::warning::", but they will bite if that gate is ever hardened.

Generated with Claude Code

Copilot

Copilot wasn't able to review any files in this pull request.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

coderabbitai · 2026-09-03T11:41:56Z

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

uv.lock is excluded by !**/*.lock, !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: 7594c51b-d5b2-4ac8-a6c8-f5855bcd5bf2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-09-03T11:42:42Z

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

pip/cryptography

50.0.1

Unknown

pip/gitpython

3.1.61

🟢 7.2

Details

Check	Score	Reason
Code-Review	⚠️ 1	Found 2/11 approved changesets -- score normalized to 1
Maintained	🟢 10	30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
Security-Policy	🟢 10	security policy file detected
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	🟢 10	project is fuzzed
License	🟢 10	license file detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches
SAST	🟢 10	SAST tool is run on all commits

pip/jupyter-builder

1.2.2

Unknown

pip/jupyter-server

2.21.0

Unknown

pip/jupyterlab

4.6.3

Unknown

pip/mistune

3.3.4

Unknown

pip/msgpack

1.2.2

Unknown

pip/notebook

7.6.2

Unknown

pip/pillow

12.3.0

Unknown

pip/pip

26.2.1

Unknown

pip/pyasn1

0.6.4

Unknown

pip/pydantic-settings

2.15.0

Unknown

pip/pymdown-extensions

11.0.2

Unknown

pip/starlette

1.6.0

Unknown

pip/tornado

6.5.8

Unknown

Scanned Files

uv.lock

Relocks uv.lock to resolve stale-dependency CVEs surfaced by the Dependency & Standards Validation pip-audit gate (28 findings across 4 packages), matching the fix already applied on PR #95 in this repo. Also fixes two real Code Quality Checks failures uncovered along the way, not suppressions: - redis_store.py: basedpyright strict flagged four hset() calls because Mapping's key parameter is invariant, so a plain dict[str, str] does not satisfy Mapping[FieldT, EncodableT] (FieldT/EncodableT are Union types) even though str is a member of that union. Cast to the upstream redis.typing aliases at each call site, matching the existing cast() convention already used in this file for hgetall()/smembers() results. - sentry.py: the uv.lock upgrade bumped ruff 0.15.16 -> 0.16.5, which newly flags init_sentry()'s 8 positional-or-keyword parameters (PLR0917). init_sentry() has no callers outside its own docstring examples, both of which already use keyword arguments, so making every parameter keyword-only is a safe, non-breaking fix. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

pip-audit runs as a hard gate inside the org reusable python-ci workflow (step "Dependency vulnerability scan"), and the default-branch lockfile carried 91 known vulnerabilities across 14 packages. That step failed on every PR, which failed "Code Quality Checks", which failed "CI Gate" and "Validation Summary". Both the ci.yml caller and the pr-validation.yml caller hit the same failure, so the whole PR queue was blocked on a default-branch problem. Targeted `uv lock --upgrade-package` for each flagged package only; no pyproject constraint was changed and no direct dependency was added or removed. Upgraded: cryptography 48.0.0 -> 50.0.1, gitpython 3.1.50 -> 3.1.61, jupyter-server 2.19.0 -> 2.21.0, jupyterlab 4.5.8 -> 4.6.3, mistune 3.2.1 -> 3.3.4, msgpack 1.1.2 -> 1.2.2, pillow 12.2.0 -> 12.3.0, pip 26.1.2 -> 26.2.1, pyasn1 0.6.3 -> 0.6.4, pydantic-settings 2.14.1 -> 2.15.0, pymdown-extensions 10.21.3 -> 11.0.2, starlette 1.2.1 -> 1.6.0, tornado 6.5.6 -> 6.5.8. Verified locally on Python 3.12: `uv lock --check` clean, `pip-audit` reports no known vulnerabilities, `osv-scanner --lockfile=uv.lock` exits 0, and the full pytest suite passes (496 passed, 1 skipped, 93.04% coverage). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

sonarqubecloud · 2026-09-04T15:30:32Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Copilot AI lite review requested due to automatic review settings September 3, 2026 11:41

Copilot AI reviewed Sep 3, 2026

View reviewed changes

williaby enabled auto-merge September 3, 2026 12:33

williaby force-pushed the claude/fix-default-branch-ci-0 branch from 57f53f7 to cb38507 Compare September 4, 2026 15:29

williaby added this pull request to the merge queue Sep 4, 2026

Merged via the queue into main with commit 1d92ae3 Sep 4, 2026
58 of 62 checks passed

williaby deleted the claude/fix-default-branch-ci-0 branch September 4, 2026 15:33

Navigation Menu

Uh oh!

Uh oh!

fix(deps): refresh uv.lock to clear 91 known vulnerabilities - #95

fix(deps): refresh uv.lock to clear 91 known vulnerabilities#95
williaby merged 1 commit into
mainfrom
claude/fix-default-branch-ci-0

williaby commented Sep 3, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

coderabbitai Bot commented Sep 3, 2026 •

edited

Loading

Review skipped

Uh oh!

github-actions Bot commented Sep 3, 2026 •

edited

Loading

Uh oh!

sonarqubecloud Bot commented Sep 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

williaby commented Sep 3, 2026

Problem

Change

Verification (local, Python 3.12)

Notes for reviewers

Out of scope, reported not fixed

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

github-actions Bot commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

sonarqubecloud Bot commented Sep 4, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai Bot commented Sep 3, 2026 •

edited

Loading

github-actions Bot commented Sep 3, 2026 •

edited

Loading