[Polichinel]

Review of the 32 Dependabot alerts GitHub raised when main was brought current. Read alert by alert, because the aggregate number is misleading in both directions.

31 of 32 are inherited, and they are C-62

package	alerts	root
Pillow	13	plotly / seaborn
GitPython	9	wandb
geopandas, torch, pytest, paramiko, pywin32, diskcache, setuptools, python-dotenv	1 each	pipeline-core 2.3.0

Every root is declared by views-pipeline-core 2.3.0. None by this repo. None imported by this repo's code. They are poetry.lock resolution, not declared dependencies.

That is C-62 exactly, so C-62 gains the measurement rather than a new entry being filed. The 3.0.0 bump it is held on removes the roots and most of this surface with them. Closing them individually would be treating symptoms of a dependency this repo does not choose.

The 32nd is ours, and it is the finding

GHSA        use-after-free when reading IPC files with pre-buffering  (HIGH)
vulnerable  >= 15.0.0, < 23.0.1
patched     23.0.1
our pin     >= 16.1.0, <  17.0.0    ← inside the range; the ceiling excludes the fix

Not exploitable here — stated precisely rather than reassuringly. The defect is on the read path; production only writes arrow. The only vf_arrow.load calls in the repository are three byte-parity tests reading fixtures we generated ourselves. There is no path from partner or producer input to the vulnerable code in this process.

Where the exposure sits is views-faoapi, which reads these shards under the same platform-wide ceiling. Our output is its input. This entry doesn't presume to size that repo's risk — it records that the pin is a shared exposure and the consumer is the reading half.

The collision worth understanding

The five byte-parity failures this repo has treated as "known local toolchain noise" all session are this CVE:

local runs pyarrow 23.0.1 — the patched version; CI runs the pinned 16.1.x; the two produce different bytes for the same input.

So upgrading to the patched pyarrow is not a dependency bump. It changes the ADR-013 §10 golden fixture — which the contract declares normative and which views-faoapi verifies against.

Security remediation here is a contract event, not maintenance, and must be sequenced with the consumer. That is now written into the trigger rather than discovered by whoever eventually runs poetry update.

Register: 72 concerns, 25 open. Integrity guard green.

🤖 Generated with Claude Code