marvin8/taibai
Watch
1
0
Fork
You've already forked taibai
 0
Code Issues Pull requests Releases 13 Activity Actions

Address transitive dependency vulnerabilities: cryptography and pydantic-settings #22

New issue
Closed
opened 2026-06-23 06:26:57 +00:00 by coding-agent-marvin8 · 1 comment
coding-agent-marvin8 commented 2026-06-23 06:26:57 +00:00 (Migrated from codeberg.org)
Copy link

pysentry reports two transitive CVEs:

HIGH — GHSA-537c-gmf6-5ccf in cryptography 46.0.7 (via keyring)
PyPI wheels for cryptography prior to 48.0.1 embed a statically-linked OpenSSL with a known vulnerability (see https://openssl-library.org/news/secadv/20250609.txt). Fix: upgrade to 48.0.1+.

MEDIUM — GHSA-4xgf-cpjx-pc3j in pydantic-settings 2.13.1 (via bump-my-version)
NestedSecretsSettingsSource with secrets_nested_subdir=True follows symlinks outside secrets_dir, bypassing the secrets_dir_max_size cap (CWE-22 / CWE-59). Fix: upgrade to 2.14.2+.

Both are transitive deps resolved by uv. The project already has a [tool.uv] constraint-dependencies section for exactly this kind of floor constraint.

pysentry reports two transitive CVEs: **HIGH** — GHSA-537c-gmf6-5ccf in cryptography 46.0.7 (via keyring) PyPI wheels for cryptography prior to 48.0.1 embed a statically-linked OpenSSL with a known vulnerability (see https://openssl-library.org/news/secadv/20250609.txt). Fix: upgrade to 48.0.1+. **MEDIUM** — GHSA-4xgf-cpjx-pc3j in pydantic-settings 2.13.1 (via bump-my-version) NestedSecretsSettingsSource with secrets_nested_subdir=True follows symlinks outside secrets_dir, bypassing the secrets_dir_max_size cap (CWE-22 / CWE-59). Fix: upgrade to 2.14.2+. Both are transitive deps resolved by uv. The project already has a [tool.uv] constraint-dependencies section for exactly this kind of floor constraint.
coding-agent-marvin8 commented 2026-06-23 06:27:08 +00:00 (Migrated from codeberg.org)
Copy link

Plan of attack:

  1. Add two entries to [tool.uv] constraint-dependencies in pyproject.toml:
    • cryptography>=48.0.1 (addresses GHSA-537c-gmf6-5ccf)
    • pydantic-settings>=2.14.2 (addresses GHSA-4xgf-cpjx-pc3j)
  2. Run uv lock --upgrade-package cryptography --upgrade-package pydantic-settings to update uv.lock.
  3. Regenerate pylock.toml.
  4. Verify with nox -s pysentry (must exit 0).
  5. Run full CI suite.
  6. Commit, push, open PR.
Plan of attack: 1. Add two entries to [tool.uv] constraint-dependencies in pyproject.toml: - cryptography>=48.0.1 (addresses GHSA-537c-gmf6-5ccf) - pydantic-settings>=2.14.2 (addresses GHSA-4xgf-cpjx-pc3j) 2. Run uv lock --upgrade-package cryptography --upgrade-package pydantic-settings to update uv.lock. 3. Regenerate pylock.toml. 4. Verify with nox -s pysentry (must exit 0). 5. Run full CI suite. 6. Commit, push, open PR.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
pages
0.10.4
0.10.3
0.10.2
0.10.1
0.10.0
0.9.0
0.8.0
0.7.0
0.6.0
0.5.0
0.4.0
0.3.0
0.2.2
0.2.1
0.2.0
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Reference
marvin8/taibai#22
No description provided.