Repository navigation
chore(deps): bump deps to patch 4 CVEs blocking CI pip-audit - #2
Merged
Merged
Conversation
Task 27 spot-check verification reclassified T-016/T-023/T-024/T-042 as NOT MATERIAL after primary-source re-read: - T-023/T-024: gtfs_rt_publisher.py:122-124 actually re-raises and emits transit.publisher.build_failed via logger.exception — original "swallows silently" claim was wrong on both rows. - T-042: models.py:73 already has Mapped[int]/SmallInteger; the ::int casts in repository.py are SQLAlchemy Row coercion, not Float→int. - T-016: pip-audit/vulture/pydeps deferred-task entry doesn't fit §B rubric; demoted from OPEN to NOT MATERIAL — DEFERRED TASK. Also softened T-017 unverified ~250KB-per-tick estimate to "multi- hundred-KB on each tick" with a measure-via-redis-cli-MONITOR note, fixed the Section 1 T-003 citation typo, and removed the Section 2 "stale log event" drift bullet that was the source of the bad T-024. Header tally adjusted to 35 net findings. Co-Authored-By: Claude <noreply@anthropic.com>
…01/T-021) Finishes T-001 codebase-wide and closes T-021. Adds BadRequestError(400), PayloadTooLargeError(413), UnsupportedMediaTypeError(415), and ServiceUnavailableError(503) to the AppError hierarchy so route handlers no longer reach for raw HTTPException — status mapping flows through app_exception_handler like the rest of the slice. 13 raises migrated across analytics (5), knowledge (5), transit (1), auth (1), and schedules (1). Kept by design: auth/dependencies (7), core/health (7), fleet webhook (2), auth refresh 401 (1), and the agent quota 429 (1) — each pinned in app/tests/test_exception_conventions.py so future regressions trip the gate. Status codes are unchanged at every site; tests that asserted on the HTTPException ``detail`` body now assert on the AppError ``error`` body. Co-Authored-By: Claude <noreply@anthropic.com>
- authlib 1.6.9 → 1.7.1 (GHSA-jj8c-mmj3-mmgv: OAuth cache CSRF) - lxml 6.0.2 → 6.1.0 (CVE-2026-41066: XXE local file read) - python-dotenv 1.2.1 → 1.2.2 (CVE-2026-28684: symlink follow) - python-multipart 0.0.22 → 0.0.27 (CVE-2026-40347: multipart DoS) - ci: add pip CVE-2026-3219 to ignore list (no upstream fix yet) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Two parallel heads existed on main: - 4863b96d1d30 (post kb-4/kb-5/lv-3-4 merge) - y9z0a1b2c3d4 (phone_assignment_partial_unique) CI's `alembic upgrade head` (singular) errors with "Multiple head revisions are present". This empty merge revision collapses them. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
linardsb
force-pushed
the
security/cve-deps-bump
branch
from
May 5, 2026 15:52
ccc9917 to
244b3fe
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
mainCI:pip-auditwas failing with 4 CVEs (run 25338489492).--ignore-vulnTest plan
Backend Checksjob passes (Dependency auditstep in particular).🤖 Generated with Claude Code