From cdbc8078b65fcf9cbbfcca96cd5633197a01e097 Mon Sep 17 00:00:00 2001 From: Ben Stull Date: Wed, 3 Jun 2026 07:56:14 -0700 Subject: [PATCH] Patch 0.31.5: pin transitive security floors (tqdm, idna) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit backend/requirements.txt carries only loose `>=` direct constraints and no compiled lockfile, so osv-scanner v2 resolves the transitive graph and pins each unpinned transitive package to its MINIMUM published version — surfacing CVEs in ancient releases pip would never install. That fired a phantom HIGH (tqdm 4.9.0, GHSA-r7q7-xcjw-qx8q) plus an idna finding on the OHM Patchwatch radar, even though the live deployment runs patched versions. Add `tqdm>=4.66.3` and `idna>=3.15` to anchor the resolver to the patched range. osv-scanner now reports zero findings. No direct-import / schema / API / config change; deployed installs already satisfy the floors. Co-Authored-By: Claude Opus 4.8 --- CHANGELOG.md | 24 ++++++++++++++++++++++++ VERSION | 2 +- backend/requirements.txt | 9 +++++++++ frontend/package.json | 2 +- 4 files changed, 35 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ad84b89..3eb641a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -23,6 +23,30 @@ skip versions are the composition of each intervening adjacent release's steps in order — no A-to-B path is pre-computed beyond that. +## 0.31.5 — 2026-06-03 + +**Patch — supply-chain hygiene: pin security floors on two unbounded +*transitive* dependencies so vulnerability scanners stay anchored to the +patched range. No direct-import, schema, API, config, overlay, or secret +change; deployed installs already satisfy these floors, so no rebuild or +redeploy is required to become compliant. No upgrade steps.** + +`backend/requirements.txt` declares only loose (`>=`) direct constraints +and ships no compiled lockfile. osv-scanner v2 resolves the *transitive* +graph and, for any unpinned transitive package, pins it to its **minimum** +published version — surfacing CVEs in ancient releases that `pip install` +would never actually choose. Two such phantoms were firing: + +- **`tqdm`** (pulled by `google-generativeai`) resolved to `4.9.0` (2016), + flagging `GHSA-r7q7-xcjw-qx8q` (HIGH) and friends — fixed in 4.66.3. +- **`idna`** (pulled by `httpx` / `anthropic`) resolved to `3.9.0`, + flagging `GHSA-65pc-fj4g-8rjx` — fixed in 3.15. + +Adding `tqdm>=4.66.3` and `idna>=3.15` anchors the resolver to the patched +range. The live deployment already runs patched versions (e.g. tqdm 4.67.x); +this only corrects what the scanner *sees*. The proper long-term fix is a +fully-compiled lockfile — tracked separately. + ## 0.31.4 — 2026-06-01 **Patch — bug fix + UI polish: secondary buttons that were invisible on diff --git a/VERSION b/VERSION index a8a0217..5f94ce0 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -0.31.4 +0.31.5 diff --git a/backend/requirements.txt b/backend/requirements.txt index 23ee1ee..bbead63 100644 --- a/backend/requirements.txt +++ b/backend/requirements.txt @@ -9,3 +9,12 @@ google-generativeai>=0.8 openai>=1.50 PyYAML>=6.0 bcrypt>=4.2 + +# Security floors on unbounded *transitive* deps (not direct imports). osv-scanner +# resolves an unpinned transitive package to its MINIMUM PyPI version, which surfaces +# CVEs in ancient releases pip would never actually install. These floors keep the +# Patchwatch radar (and any scan) anchored to the patched range. +# tqdm <- google-generativeai ; GHSA-r7q7-xcjw-qx8q et al., fixed in 4.66.3 +# idna <- httpx / anthropic ; GHSA-65pc-fj4g-8rjx, fixed in 3.15 +tqdm>=4.66.3 +idna>=3.15 diff --git a/frontend/package.json b/frontend/package.json index ac13081..f3dc192 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -1,7 +1,7 @@ { "name": "rfc-app-frontend", "private": true, - "version": "0.31.4", + "version": "0.31.5", "type": "module", "scripts": { "dev": "vite",