Repository navigation
chore(security): review the pip-audit baseline on its due date - #421
Conversation
SECURITY_GATES.md §7e set 2026-09-30 as the review date for five of the six ignored advisories. Every entry was re-checked with pip-audit 2.10.1, OSV.dev and PyPI. - pip-audit now emits the three 2026-08-24 chromadb advisories as PYSEC-2026-3813/3815/3814. The CVE flags still held them, but only through aliases, the silent failure mode §7e warns about. The flags now use the canonical IDs; the audit still reports 'No known vulnerabilities found, 8 ignored'. - chromadb 1.5.9, the latest release, is still inside all four advisories' range, and chromadb is still not in the backend image. - ecdsa had a row and no written disposition. It is shipped, through python-jose, and its advisory (CVE-2024-23342, a timing attack on ECDSA signing) has no fix in any version. It is not reachable: JWTs are HS256, decode pins the algorithm, and nothing imports ecdsa. Replacing python-jose would remove it for good and belongs in its own issue. Next review by 2026-12-31 (oauthlib keeps 2026-10-31). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 931d068c59
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| **6 vulnerability IDs ignored** (down from 33 at gate introduction). Owner: | ||
| platform owner. SLA: next dependency-upgrade window (review by 2026-09-30). | ||
| platform owner. SLA: reviewed quarterly, or sooner when an entry's review date | ||
| comes first (last review 2026-09-30; next by 2026-12-31). |
There was a problem hiding this comment.
The stated next review date skips the oauthlib exception, whose table row and new review note retain a 2026-10-31 deadline. If operators follow this section-level SLA, that exception will go unreviewed for two months past its deadline; the next review should be 2026-10-31, with 2026-12-31 applying only to the other five entries.
Useful? React with 👍 / 👎.
1 participant
SECURITY_GATES.md§7e set 2026-09-30 as the review date for five of the six ignored advisories. Every entry was re-checked with pip-audit 2.10.1, OSV.dev and PyPI.PYSEC-2026-3813/3815/3814. The CVE flags were holding them through aliases only, the silent failure mode §7e warns aboutlast_affected: 1.5.9). Still not in the backend image (dry-run 2026-09-29)python-jose. CVE-2024-23342 (Minerva timing attack on ECDSA signing) has no fix in any version. It had no written disposition until now. Not reachable: JWTs are HS256,decodepins the algorithm, nothing importsecdsaWith the new flags:
No known vulnerabilities found, 8 ignored, the same as before the switch.Follow-up worth its own issue: replacing
python-jose(e.g. with PyJWT) would dropecdsafrom the image entirely.🤖 Generated with Claude Code