fix(security): bump yt-dlp, setuptools, torch to patched releases - #1033
fix(security): bump yt-dlp, setuptools, torch to patched releases#1033seonghobae wants to merge 11 commits into
Conversation
Remediates the three open Dependabot alerts on develop: - GHSA-6v4j-43gg-vj32 (HIGH, yt-dlp < 2026.7.4): floor raised to the latest 2026.8.19 release ahead of the advisory window. - GHSA-h35f-9h28-mq5c (MEDIUM, setuptools < 83.0.0): transitive pin refreshed to 84.0.0 through the lockfile. - torch <= 2.12.1 (LOW): demucs's torch dependency updated to 2.13.0. uv.lock regenerated with uv's own resolver; full analysis-engine suite passes (679 passed, 24 skipped) on Python 3.14.
📝 WalkthroughWalkthroughPython 분석 의존성 기준을 갱신했습니다. ChangesPython 의존성 보안 기준선
Estimated code review effort: 2 (Simple) | ~15 minutes Merge Risk: 🔵 Low · up to The dependency baseline is updated to patched releases, but the regression test does not directly verify that torch remains excluded on macOS Intel. The PR is mergeable with explicit owner awareness or a follow-up to assert that platform condition. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
Please provide the required independent OpenCode review for current HEAD 046db56. Refetch this SHA and the protected base before reviewing; submit a formal current-head verdict only after independent review. |
|
@opencode-agent Review only PR #1033 on unchanged exact head |
|
Queued @opencode-agent for PR #1033 at head |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head product diff. Coverage is a separate gate.
Changed files
.trivyignore— repository behaviorCHANGELOG.md— repository behaviordocs/security/dependency-policy.md— operator or user guidanceservices/analysis-engine/pyproject.toml— repository behaviorservices/analysis-engine/tests/test_python_dependency_security_baseline.py— regression suiteservices/analysis-engine/uv.lock— repository behavior
Changed behavior
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Repository file: .trivyignore"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Repository file: .trivyignore"]
R1 --> V1["required checks"]
Evidence --> S2["Repository file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Repository file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: dependency-policy.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: dependency-policy.md"]
R3 --> V3["docs review"]
Evidence --> S4["Repository file: pyproject.toml"]
S4 --> I4["repository behavior"]
I4 --> R4["Review risk: Repository file: pyproject.toml"]
R4 --> V4["required checks"]
Evidence --> S5["Test: test_python_dependency_security_baseline.py"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test: test_python_dependency_security_baseline.py"]
R5 --> V5["targeted test run"]
Evidence --> S6["Repository file: uv.lock"]
S6 --> I6["repository behavior"]
I6 --> R6["Review risk: Repository file: uv.lock"]
R6 --> V6["required checks"]
Findings
No source-backed product finding is synthesized from the coverage gate. A coverage miss belongs in the status comment.
- Head SHA:
046db562497a8104fa525f56a6437eb13fbf4760 - Workflow run: 33245610267
- Workflow attempt: 1
- Coverage gate:
failure
Review outcome
Coverage is a gate, not the review. This body reviews the changed product files.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Repository file: .trivyignore"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Repository file: .trivyignore"]
R1 --> V1["required checks"]
Evidence --> S2["Repository file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Repository file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: dependency-policy.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: dependency-policy.md"]
R3 --> V3["docs review"]
Evidence --> S4["Repository file: pyproject.toml"]
S4 --> I4["repository behavior"]
I4 --> R4["Review risk: Repository file: pyproject.toml"]
R4 --> V4["required checks"]
Evidence --> S5["Test: test_python_dependency_security_baseline.py"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test: test_python_dependency_security_baseline.py"]
R5 --> V5["targeted test run"]
Evidence --> S6["Repository file: uv.lock"]
S6 --> I6["repository behavior"]
I6 --> R6["Review risk: Repository file: uv.lock"]
R6 --> V6["required checks"]
OpenCode Review Overview
Coverage evidence did not pass, so approval is blocked. The formal pull-request review is the source-backed diff review, not this status comment. |
1 participant
Python dependency security owner
Repairs the BandScope analysis-engine security baseline without treating an elective scientific-runtime upgrade as ordinary dependency churn.
setuptoolsis locked to84.0.0; the repository's recorded floor forGHSA-h35f-9h28-mq5cis>=83.0.0.torchis locked to2.13.0; the repository's recorded advisory boundary has<=2.12.1affected. Torch remains transitive through Demucs on admitted platforms.yt-dlpis advanced to2026.8.19as remote-media hardening; the documented advisory minimum is kept distinct from this forward version.Exact current identity
develop@889d782e88b4df28dcbb4ae3cfd6d99ef85d9844.fix/python-dep-cves-ytdlp-setuptools-torch.a13f8258d1403a6cd68fd177df222672013a46dd..trivyignore,CHANGELOG.md,docs/security/dependency-policy.md, analysispyproject.toml, the dependency-security regression, anduv.lock.Commit
a13f8258...is a normal two-parent descendant of predecessor head046db562...and protecteddevelop@889d782.... The only intervening protected delta was the TauriCargo.lock; this branch adopts that protected blob exactly. No force-push/destructive rebase or predecessor evidence transfer was used.Regression and owner boundary
test_python_dependency_security_baseline.pyis the owner-level regression for exact patched lock versions, retired exception text, and the macOS Intel exclusion contract. This PR owns the security baseline, not future scientific-performance adoption of arbitrary latest torch releases.Dependabot #1164 currently combines
setuptools 81→83with transitivetorch 2.12.1→2.14.0in a lock-only update. Its setuptools security objective is already superseded here by 84.0.0. Its remaining unique delta is torch 2.14, whose own release notes include backwards-incompatible changes and whose resolved CUDA dependency topology changes materially. That elective scientific/runtime move must be evaluated separately against Demucs compatibility, rights-cleared real decoded audio, reproducibility, supported backend parity and performance; it must not overwrite this security owner or inherit this PR's evidence.Verification boundary
All hosted results before
a13f8258d1403a6cd68fd177df222672013a46ddare predecessor-only. Keep Draft until this unchanged head has applicable CI, dependency/security audit, SAST, SBOM/supply-chain, coverage, release/build and central review gates terminal-success, zero valid unresolved findings and a qualifying independent non-author last-push approval. Do not reuse #1164 or predecessor-head checks, self-approve, bypass protection, or suppress a failing gate.