From 8ff8e93f0f66c6cca0fa8479404e96628ee6b2b1 Mon Sep 17 00:00:00 2001 From: Christopher Sellers <1@christophersellers.com> Date: Sat, 31 Oct 2026 01:14:03 -0700 Subject: [PATCH 1/2] fix(deps): bump pypdf to 6.21.4 for factory-local pip-audit pip-audit flags seven CVEs against pypdf 6.21.2 in packages/factory-local/requirements.lock. Raise the pin to >=6.21.4,<7 (smallest fix for CVE-2026-119203/119204/119205; also covers CVE-2026-119206/119207/119208/119209 fixed in 6.21.3) and regenerate the factory-local and root hashed locks. Root lock also picks up pyasn1 0.6.5 (CVE-2026-119194/119195/119196/119197) so pip-audit stays clean once the check runs. Frontend overrides match #3770 so npm audit --audit-level=high does not fail the same Dependency Audit job. Signed-off-by: Christopher Sellers <1@christophersellers.com> --- frontend/package-lock.json | 21 ++++++++++++++------- frontend/package.json | 3 ++- packages/factory-local/requirements.lock | 6 +++--- packages/factory-local/requirements.txt | 2 +- requirements.in | 2 +- requirements.lock | 23 +++++++---------------- 6 files changed, 28 insertions(+), 29 deletions(-) diff --git a/frontend/package-lock.json b/frontend/package-lock.json index c23efbbc5..a24cc87ab 100644 --- a/frontend/package-lock.json +++ b/frontend/package-lock.json @@ -1405,6 +1405,12 @@ "url": "https://opencollective.com/libvips" } }, + "node_modules/@isaacs/nonrecursive-glob-match": { + "version": "1.0.3", + "resolved": "https://registry.npmjs.org/@isaacs/nonrecursive-glob-match/-/nonrecursive-glob-match-1.0.3.tgz", + "integrity": "sha512-SI7kyKHq4XXDRozw+r9GlRZkia1ZkFrpLW98r2IC2Bpr8YkFGE3fvjzmxCG0x78A++69HmDNrDvSMYBZmHGpKA==", + "license": "BlueOak-1.0.0" + }, "node_modules/@jest/diff-sequences": { "version": "30.0.1", "resolved": "https://registry.npmjs.org/@jest/diff-sequences/-/diff-sequences-30.0.1.tgz", @@ -7866,9 +7872,9 @@ "license": "ISC" }, "node_modules/follow-redirects": { - "version": "1.16.1", - "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.1.tgz", - "integrity": "sha512-FNvFGzoMLWmE6Yj9spb/zjd7yiNCHiAW9/Tg9CXrQ8wuu32HtlJOwWO11OJafl5FfY3DxTdQ0vj42zU1kvv5jg==", + "version": "1.16.2", + "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.2.tgz", + "integrity": "sha512-/kVP2U8z596Ia0gwFrwyIeo74ta5aVmSeU1FfAUMAmcEP5EP7zydmag3SLiN64NaRKef3lxsq7i/g7ltJQDGow==", "funding": [ { "type": "individual", @@ -9823,12 +9829,13 @@ } }, "node_modules/minimatch": { - "version": "10.2.4", - "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.4.tgz", - "integrity": "sha512-oRjTw/97aTBN0RHbYCdtF1MQfvusSIBQM0IZEgzl6426+8jSC0nF1a/GmnVLpfB9yyr6g6FTqWqiZVbxrtaCIg==", + "version": "11.0.3", + "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.3.tgz", + "integrity": "sha512-iny/40PEGkNJQ5/Pv6z3nm6FbRAby32GeZRjCUJk2WnNDbgPSTcdI+DDvLqsgBdD4cD5sMtMheqPPnehCCa8Nw==", "license": "BlueOak-1.0.0", "dependencies": { - "brace-expansion": "^5.0.2" + "@isaacs/nonrecursive-glob-match": "^1.0.3", + "brace-expansion": "^5.0.12" }, "engines": { "node": "18 || 20 || >=22" diff --git a/frontend/package.json b/frontend/package.json index 7fbbfb069..f754526bd 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -105,7 +105,8 @@ "rollup": "4.59.0", "esbuild": "0.27.3", "fast-uri": "^3.1.5", - "minimatch": ">=3.1.3", + "follow-redirects": ">=1.16.2", + "minimatch": ">=11.0.1", "postcss": "^8.5.18", "serialize-javascript": "7.0.3", "workbox-build": { diff --git a/packages/factory-local/requirements.lock b/packages/factory-local/requirements.lock index 925eeb74c..700b730d0 100644 --- a/packages/factory-local/requirements.lock +++ b/packages/factory-local/requirements.lock @@ -1235,9 +1235,9 @@ pygments==2.21.0 \ --hash=sha256:2363c69b61c4a97c838da3b130dcd6468f4848992b21a82f2a63ec34377137d9 \ --hash=sha256:610ca751c9bc2492b38eb9a38a7fbc93edbbb2d7182edaf34e66ae493dee5c8c # via pytest -pypdf==6.21.2 \ - --hash=sha256:0a3e1c5c886a1be03646c16a04827cc166c2a0575c971b26a4bf89686551c2d4 \ - --hash=sha256:1d44d1a3a200f25062adff0085b02040e4646431ac2ccac22e42679e91466084 +pypdf==6.21.4 \ + --hash=sha256:33e4fb41ca352810eb4e9838aa0d82d6888a5f8bf682f43e99cce5faa666255c \ + --hash=sha256:c8817e3f888d47a087872ded69812c1ef30cacb871d6e053e0c00bbaf0bc2163 # via -r requirements.txt pytest==9.1.1 \ --hash=sha256:1088fbde8f2b49d95a549a195707afa7a76a3ce9bcadc26b6d71f0ffda5fe313 \ diff --git a/packages/factory-local/requirements.txt b/packages/factory-local/requirements.txt index 890ce9304..778f4f886 100644 --- a/packages/factory-local/requirements.txt +++ b/packages/factory-local/requirements.txt @@ -8,6 +8,6 @@ neo4j>=5.23,<6 streamlit>=1.38,<2 pytest>=9.0.3,<10 beautifulsoup4>=4.12,<5 -pypdf>=6.21.2,<7 +pypdf>=6.21.4,<7 openai>=1.40,<3 python-dotenv>=1.0,<2 diff --git a/requirements.in b/requirements.in index 7d228d4e5..0d6a98310 100644 --- a/requirements.in +++ b/requirements.in @@ -163,7 +163,7 @@ beautifulsoup4>=4.15.0 lxml>=6.1.3 pdfminer.six>=20260107 pdfplumber>=0.11.10 -pypdf>=6.21.2,<7 # CVE-2026-115572/115580/115585; CVE-2026-71852, CVE-2026-71870; earlier: CVE-2026-59935/59936 (inline-image DoS), CVE-2026-48155/48156, GHSA-jm82-fx9c-mx94 +pypdf>=6.21.4,<7 # CVE-2026-119203/119204/119205 (6.21.4); CVE-2026-119206/119207/119208/119209 (6.21.3); earlier: CVE-2026-115572/115580/115585, CVE-2026-71852/71870, CVE-2026-59935/59936, CVE-2026-48155/48156, GHSA-jm82-fx9c-mx94 fpdf2>=2.8.9,<3 python-docx>=1.2.0 docx2txt>=0.9 diff --git a/requirements.lock b/requirements.lock index 98bb01f8b..97a559ee1 100644 --- a/requirements.lock +++ b/requirements.lock @@ -1,5 +1,5 @@ # -# This file is autogenerated by pip-compile with Python 3.11 +# This file is autogenerated by pip-compile with Python 3.13 # by the following command: # # pip-compile --allow-unsafe --generate-hashes --output-file=requirements.lock requirements.in @@ -2999,9 +2999,9 @@ psycopg-binary==3.3.6 \ --hash=sha256:fa34eb47969297471db7b7f193622c7e3ee839ec05abd05f1fe104d5b1b1dcf4 \ --hash=sha256:fdccb3a0e184b03e9baa673b15a809cf36c339c85dbda0ebc25a698846dfbee8 # via psycopg -pyasn1==0.6.4 \ - --hash=sha256:9c447d8431c947fe4c8febc4ed9e760bc29011a5b01e5c74b67025bd9fb8ce81 \ - --hash=sha256:deda9277cfd454080ec40b207fb6df82206a3a2688735233cdcd8d3d565f088b +pyasn1==0.6.5 \ + --hash=sha256:4017b0fce125096b8573b39c989fdb1a4b19cf761e683398184550fea0e66587 \ + --hash=sha256:6b11616a6bcf3a40e635f082bb232fa57b5e0dd7f517bd7ddd69ec3794508a47 # via # pyasn1-modules # webauthn @@ -3202,9 +3202,9 @@ pyotp==2.10.0 \ --hash=sha256:1df2f6a1bcc3bb0716172a5215ddc2f8c7c7fd26a13df9927d52e1746934836c \ --hash=sha256:d01e9703443616b03c57c700b5cbffd56a1f929c1b0f8f03131bc78c1fca9d3f # via -r requirements.in -pypdf==6.21.2 \ - --hash=sha256:0a3e1c5c886a1be03646c16a04827cc166c2a0575c971b26a4bf89686551c2d4 \ - --hash=sha256:1d44d1a3a200f25062adff0085b02040e4646431ac2ccac22e42679e91466084 +pypdf==6.21.4 \ + --hash=sha256:33e4fb41ca352810eb4e9838aa0d82d6888a5f8bf682f43e99cce5faa666255c \ + --hash=sha256:c8817e3f888d47a087872ded69812c1ef30cacb871d6e053e0c00bbaf0bc2163 # via -r requirements.in pypdfium2==5.13.0 \ --hash=sha256:07f58e91b8c45ca144a1ff3008faf3c73ef8a5e9fb32988831788363288228cd \ @@ -3852,15 +3852,11 @@ typing-extensions==4.16.0 \ --hash=sha256:481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8 \ --hash=sha256:dc983d19a509c94dba722ee6abd33940f7c05a89e243c47e907eb4db6f1a43e5 # via - # aiohttp - # aiosignal # alembic - # anyio # beautifulsoup4 # fastapi # groq # grpcio - # httpx2 # langchain-core # langchain-protocol # langsmith @@ -3872,18 +3868,13 @@ typing-extensions==4.16.0 \ # opentelemetry-exporter-otlp-proto-http # opentelemetry-sdk # opentelemetry-semantic-conventions - # psycopg # pydantic # pydantic-core # pydantic-settings - # pyopenssl - # pytest-asyncio # python-docx # realtime - # referencing # resend # sqlalchemy - # starlette # stripe # testcontainers # typesafe-sdk From 15e69f5cb24a17402cdb9d56d6b1b4d20000ca21 Mon Sep 17 00:00:00 2001 From: Christopher Sellers <1@christophersellers.com> Date: Sat, 31 Oct 2026 01:39:03 -0700 Subject: [PATCH 2/2] fix(deps): recompile requirements.lock with Python 3.11 Dependency Lock Freshness runs pip-compile on 3.11; the prior lock header and typing-extensions via annotations were from 3.13. Signed-off-by: Christopher Sellers <1@christophersellers.com> --- requirements.lock | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/requirements.lock b/requirements.lock index 97a559ee1..133aa6865 100644 --- a/requirements.lock +++ b/requirements.lock @@ -1,5 +1,5 @@ # -# This file is autogenerated by pip-compile with Python 3.13 +# This file is autogenerated by pip-compile with Python 3.11 # by the following command: # # pip-compile --allow-unsafe --generate-hashes --output-file=requirements.lock requirements.in @@ -3852,11 +3852,15 @@ typing-extensions==4.16.0 \ --hash=sha256:481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8 \ --hash=sha256:dc983d19a509c94dba722ee6abd33940f7c05a89e243c47e907eb4db6f1a43e5 # via + # aiohttp + # aiosignal # alembic + # anyio # beautifulsoup4 # fastapi # groq # grpcio + # httpx2 # langchain-core # langchain-protocol # langsmith @@ -3868,13 +3872,18 @@ typing-extensions==4.16.0 \ # opentelemetry-exporter-otlp-proto-http # opentelemetry-sdk # opentelemetry-semantic-conventions + # psycopg # pydantic # pydantic-core # pydantic-settings + # pyopenssl + # pytest-asyncio # python-docx # realtime + # referencing # resend # sqlalchemy + # starlette # stripe # testcontainers # typesafe-sdk