fix(security): floor cryptography / python-multipart / starlette to clear active CVEs#791
Merged
Conversation
…lear active CVEs Develop's Python deps CVE scan started failing after fresh advisories were published against transitive dependencies. None of these were explicitly pinned in apps/engine/pyproject.toml at versions above the patched floor, so 'uv lock' was happily resolving the vulnerable versions and the gate was blocking every Python PR (#789, #790, plus any future ones). Add explicit floors: - cryptography>=48.0.1 GHSA-537c-gmf6-5ccf - python-multipart>=0.0.31 CVE-2026-53538/53539/53540 - starlette>=1.3.1 CVE-2026-54282/54283 Resolution result (uv.lock): cryptography 48.0.0 -> 49.0.0 python-multipart 0.0.28 -> 0.0.32 starlette 1.1.0 -> 1.3.1 Smoke-test sweep on the bumped resolution passes the same set develop passes today — the two failures observed (test_assistant test_chat_returns_assistant_message and test_error_explainer test_explain_endpoint_ai_falls_back_to_deterministic_without_provider) also fail on develop verbatim, are unrelated to the bumps, and stem from a pre-existing GLM provider auto-detection bug. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Starlette 1.3 ships stricter type stubs and httpx now returns ``Any`` for ``response.status_code`` in some contexts, so the ``return 200 <= response.status_code < 300`` pattern in the standalone JWT-login helpers trips mypy's ``no-any-return``. Explicit ``bool(...)`` keeps the semantics identical and gives mypy a concrete annotation without an ``# type: ignore`` escape hatch. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
rlagowski
approved these changes
Jun 17, 2026
This was referenced Jun 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Develop's
Python deps CVE scanstarted failing after fresh advisories were published against transitive dependencies. The CVE gate is now blocking every Python PR (#789, #790, and any new ones) because none of these were pinned at versions above the patched floor —uv lockwas happily resolving the vulnerable versions.Adds explicit floors in
apps/engine/pyproject.toml:cryptography>=48.0.1python-multipart>=0.0.31starlette>=1.3.1Test plan
uv lock --checkcleantest_assistant::test_chat_returns_assistant_message,test_error_explainer::test_explain_endpoint_ai_falls_back_to_deterministic_without_provider) are reproducible on develop verbatim and unrelated to these bumps (pre-existing GLM provider auto-detection bug)Python deps CVE scangreen on this PRNotes
uvpicked higher resolutions because the resolver prefers newest within the constraint range.🤖 Generated with Claude Code