Code Security: ecosystem dependency-CVE audit (2026-07-30) — remediation status + residuals

[seonghobae]

Centralized Code-Security governance record for a dependency-CVE sweep across the ecosystem's Python (pip-audit) and Node (npm/pnpm audit) lockfiles on 2026-07-30. Filed so findings live in the repo/Project rather than private agent memory, and so the higher-risk residuals get deliberate handling instead of an under-verified auto-bump.

Remediated this pass (fixed at base, verified, pushed)

Repo	Finding	Fix	Verification
pg-erd-cloud (#683, 2afce4e)	pydantic-settings 2.12.0 GHSA-4xgf-cpjx-pc3j; pyasn1 0.6.3 PYSEC-2026-3455/3456/3457	regen hash locks → 2.14.2 / 0.6.4	--require-hashes install hash-valid, app.main imports, mypy 68 files clean
noema (#23, 4696a13)	postcss <=8.5.17 GHSA-r28c-9q8g-f849 (high)	overrides → ^8.5.18 (8.5.25)	typecheck clean, test 61 passed, security:scan 0 vulns

Open residuals (severity-classified, needing care or follow-up)

Repo	Package	Severity	Fix path	Handling
argos packages/web	next-auth 5.0.0-beta.30 → beta.32 (+ @auth/core → 0.41.3)	critical (GHSA-8fpg-xm3f-6cx3, GHSA-7rqj-j65f-68wh)	same-beta-series prerelease bump	Needs a verified auth-flow bump — beta API can shift; requires the full web test suite + auth e2e before merge. Not auto-bumped.
argos	brace-expansion <1.1.16 (95 dev paths)	high (ReDoS)	pnpm overrides → >=1.1.16	low-risk dev/transitive; can ride the same argos auth PR
pg-erd-cloud frontend	(npm high, 1)	high	frontend lock bump	candidate for the postcss/sharp override pattern
bandscope	(npm high, 2)	high	lock/override	strict 100% gates — verify quickcheck after bump
scopeweave	(npm moderate, 1)	moderate	lock bump	lower priority
codec-carver	setuptools 82.0.1 PYSEC-2026-3447	(build-time)	lock regen	low priority; build-only
pg-erd-cloud (backend)	ecdsa 0.19.2 PYSEC-2026-1325	—	no upstream fix published	--ignore-unfixed; track for a future release

Clean (no known vulnerabilities)

contextual-orchestrator, semantic-data-portal (Python); naruon frontend (pnpm).

Note: all remediation PRs above are currently gated from merging by the org-wide opencode-review: exhausted state (the reviewer-provider credential is not yet provisioned), tracked separately at #624 — the fixes are staged and verified, awaiting pipeline recovery.