Repository navigation
build(deps): bump authlib to 1.9.1 and dnspython to 2.9.0 to clear pip-audit CVEs - #3686
PetrefiedThunder wants to merge 1 commit into
Conversation
…p-audit CVEs pip-audit fails the Security Audit matrix on every PR because requirements.lock pins authlib 1.8.0, which carries CVE-2026-96760 and CVE-2026-114615 through -114620 (JWS signature verification bypass, empty audience in the RFC 7523 bearer grant, OctKey public-key misuse, nonce and JAR request validation). All are fixed in 1.9.0; 1.9.1 is current (2026-10-14). A local run of the same pip-audit command then surfaced dnspython 2.8.0, CVE-2026-114605 (CPU exhaustion on crafted DNS wire messages), fixed in 2.9.0, so both move together. Backend CI Status Gate and PR Gate: Backend fail downstream of the audit, so this unblocks the whole backend gate. authlib is a direct requirement (requirements.in) and a confluent-kafka dependency; no RegEngine module imports it and the schema-registry client that would use it is not wired (services/ingestion/app/kafka_utils.py). dnspython is transitive via email-validator (EmailStr fields in the admin service). Lock regenerated with the CI command (pip 24.3.1, pip-tools 7.5.2, Python 3.11, --upgrade-package for the two packages); a plain recompile is a no-op, as the freshness gate requires. Only the two pins and their hashes change. pip-audit 2.10.0 with CI's ignore list: no known vulnerabilities. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: 29d484b1-8ad2-4075-9b41-0fecacd290b3) |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
No actionable comments were generated in the recent review.
 |
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title clearly identifies the dependency updates and their purpose: resolving pip-audit CVEs. It accurately reflects the primary changes. |
| Description check | |
The description provides a detailed summary, security rationale, runtime impact, validation results, and test status. It omits the template's explicit Type of Change, Checklist, and Related Issues sec… |
| Docstring Coverage | |
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
Full details: Description check
-
Explanation
The description provides a detailed summary, security rationale, runtime impact, validation results, and test status. It omits the template's explicit Type of Change, Checklist, and Related Issues sections, but the required change and verification information is substantially covered.
Full details: Docstring Coverage
-
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
PetrefiedThunder
left a comment
PetrefiedThunder
left a comment
There was a problem hiding this comment.
Independent engine review: Muse
REVIEW: PASS muse 0df5128
Muse Code 1.4.14 reviewed the full diff at 0df51282945d1c43564b953dc3535562894a20fe read-only (write, shell and web tools disabled). Verdict: PASS, no blocking or non-blocking findings: only authlib (1.8.0 to 1.9.1) and dnspython (2.8.0 to 2.9.0) change, each with consistent version and hash lines, and the requirements.in change is exactly the authlib floor. Claude Code posted this on Christopher's account at his request.
Muse listed what it could not verify offline; Claude checked these separately:
- Hash authenticity: authlib 1.9.1: 2 lock hashes, all present among 2 PyPI artifact digests; dnspython 2.9.0: 2 lock hashes, all present among 2 PyPI artifact digests (checked against pypi.org JSON on 2026-10-28).
- Lock regeneration: produced with the CI command (pip 24.3.1, pip-tools 7.5.2, Python 3.11,
--upgrade-packagefor the two packages); a plain recompile is a no-op. - pip-audit:
pip-audit 2.10.0 -r requirements.lockwith CI's ignore list reports no known vulnerabilities. - Runtime exposure: no RegEngine module imports
authlib, and the confluent-kafka schema-registry client that would use it is not wired;dnspythonis reached only throughemail-validator.
This verdict covers commit 0df51282945d1c43564b953dc3535562894a20fe only.
PR Blocker ChecklistHead SHA: Status: Ready
|
github-actions
Bot
added
the
dependencies
|
Closing as superseded: #3636 (merged to main) regenerated requirements.lock with authlib 1.9.1 and dnspython 2.9.0 and raised both floors in requirements.in, so after merging main this PR has an empty diff. The merged lock passes pip-audit 2.10.0 with CI's ignore list (no known vulnerabilities; checked locally 2026-10-28). Nothing from this branch is needed. 🤖 Generated with Claude Code |
Summary
Every open PR fails Security Audit (all six service jobs), and therefore Backend CI Status Gate and PR Gate: Backend, because
requirements.lockpinsauthlib 1.8.0. pip-audit flags seven CVEs on it (CVE-2026-96760, CVE-2026-114615 to -114620; JWS signature bypass, empty audience in the RFC 7523 bearer grant, OctKey misuse, nonce and JAR validation), all fixed in 1.9.0. main carries the same pin, so this is pre-existing, not caused by any PR.Running CI's exact pip-audit command on the fixed lock then surfaced one more:
dnspython 2.8.0, CVE-2026-114605 (CPU exhaustion on crafted DNS wire messages), fixed in 2.9.0. Both move in this PR.requirements.in:authlib>=1.8.0toauthlib>=1.9.1(dnspython is transitive, via email-validator, so no floor change)requirements.lock:authlib 1.8.0to1.9.1,dnspython 2.8.0to2.9.0, with hashes. Nothing else changes.Found while fixing CI on #3679. Dependabot's #3634 also bumps authlib, inside a 17-package group; this PR is the two-pin minimum so the gate can go green on its own.
Runtime impact
authlib. It is a direct requirement and aconfluent-kafkadependency, and the schema-registry client that would use it is not wired (services/ingestion/app/kafka_utils.py).dnspythonis used byemail-validatorbehindEmailStrfields in the admin service. 2.9.0 is a DoS fix with no API change noted in its release.Checks
--upgrade-packagefor the two pins)pip-compilerecompile (the freshness gate)pip-audit 2.10.0 -r requirements.lockwith CI's ignore listNot run locally: the backend test matrix. CI runs it on this PR.
After merge
Re-run CI on #3679 (and the other open PRs); they pick up this lock through the merge ref without a rebase.
🤖 Generated with Claude Code
Note
Low Risk
Dependency-only CVE remediation with no application logic changes; dnspython and authlib bumps are patch/minor security releases.
Overview
Unblocks Security Audit and backend CI gates by raising pinned versions that pip-audit was flagging.
requirements.infloorsauthlibfrom>=1.8.0to>=1.9.1(seven JWS/OAuth-related CVEs on 1.8.0).requirements.lockpinsauthlib 1.9.1and bumps transitivednspythonfrom 2.8.0 to 2.9.0 (CVE-2026-114605 DoS on crafted DNS messages), pulled in viaemail-validator—no direct floor change for dnspython.This is a lock-only security refresh with updated hashes; application code is unchanged.
authlibis not imported in RegEngine Python modules today;dnspythonsits behindEmailStrvalidation in the admin service.Reviewed by Cursor Bugbot for commit 0df5128. Bugbot is set up for automated code reviews on this repo. Configure here.