Skip to content

Daily security sweep — backlog #40

Open
Open
Daily security sweep — backlog#40
Labels
dependenciesDependency updates

Description

@benfrank241
benfrank241
opened on Sep 21, 2026

Backlog from the daily security sweep for vectorize-io/pg0. This issue tracks advisories the sweep found but deliberately did not bundle into a PR, with the reason for each. Later runs append to it.

Dependabot alerts on this repo return 0 in every state (open, fixed, dismissed), but the lockfiles contain real advisories. The sweep therefore fell back to checking the GitHub Advisory DB against the lockfiles directly. Recommend enabling Settings → Code security → Dependabot alerts.

Shipped on 2026-09-21: #39 is a Cargo.lock lockfile-only patch for rustls-webpki (high), quinn-proto (high ×2), tar, bytes and rand. It passed the local cargo build --release / cargo test --release check.

2026-09-21: sdk/python/uv.lock, pytest GHSA-6w46-j5rx-g56g (medium, dev-only)

Resolution leg Locked Fixed in
python_full_version >= '3.10' pytest 9.0.1 9.0.3
python_full_version == '3.9.*' pytest 8.4.2 none installable (pytest ≥9.0.3 requires Python ≥3.10)
python_full_version < '3.9' pytest 8.3.5 none installable

Why no PR.

  1. A lockfile bump can fix only the ≥3.10 leg. The 3.8 and 3.9 legs cannot be patched without raising requires-python = ">=3.8", and that change is a maintainer decision. 3.8 and 3.9 are both EOL, but the classifiers still advertise them.
  2. CI does not consume this lockfile: ci.yml runs uv pip install --system -e ".[dev]", which resolves pytest fresh (currently 9.1.1). Published wheels do not ship it either, so only local uv sync dev environments are affected.
  3. It is a dev-only extra ([project.optional-dependencies] dev = ["pytest>=8.0.0"]), so it has no runtime exposure. It was not dismissed, because no Dependabot alert exists to dismiss.

Suggested fix (human): raise requires-python to >=3.10, which collapses the fork, and trim the 3.8/3.9 classifiers. Then run uv lock --upgrade-package pytest.

Activity

  1. benfrank241
    added
    dependenciesDependency updates
    on Sep 21, 2026

  2. benfrank241 commented on Oct 24, 2026

    @benfrank241
    benfrank241
    on Oct 24, 2026
    MemberAuthor

    2026-10-24 sweep update

    Shipped: #44 is a Cargo.lock lockfile-only patch that clears 24 advisories (quinn-proto, rustls, rustls-webpki, webpki-roots, tar, tokio, bytes, rand, anyhow, event-listener). It supersedes #39 and includes all of #39's bumps. cargo build --release and cargo test --release both pass locally (12/12).

    New backlog items:

    1. Cargo.lock: zip 2.4.2 and 4.6.1. Advisories GHSA-vv5m-jxxh-4627, GHSA-4v9h-p7m9-rh26 and GHSA-4684-h2q9-2vcp are fixed only in zip 9.0.0, which is a major bump. The direct zip = "2" dependency (Windows only) would need a manifest major bump, and the 4.6.1 copy comes from postgresql_archive 0.20, so it needs an upstream release. Maintainer decision.
    2. Cargo.lock: instant 0.1.13. RUSTSEC-2024-0384 (unmaintained) has no fix. It arrives via parking_lot 0.11 ← reqwest-retry 0.7 ← postgresql_archive. Informational only.
    3. sdk/python/uv.lock: pygments 2.19.2. GHSA-5239-wwwm-4pmq (low, dev-only, pulled in by pytest on the 3.9 and ≥3.10 legs) is fixed in 2.20.0 (requires_python >=3.9). Not bundled: a no-op uv lock on pristine main is not byte-identical under uv 0.11.18. It rewrites 140 lines and bumps the stale pg0-embedded 0.10.1 → 0.15.2 self-entry. Any bump would therefore carry unrelated normalization churn. As noted above, CI resolves fresh and does not consume this lock. The pytest item from 2026-09-21 is unchanged.

    🤖 Generated with Claude Code

  3. benfrank241 commented on Oct 24, 2026

    @benfrank241
    benfrank241
    on Oct 24, 2026
    MemberAuthor

    2026-10-24: CI on #44 is red for a reason unrelated to the change (repo-wide build break)

    Four Linux glibc jobs on #44 fail: Python Wheels / Build wheel (linux-x86_64-gnu), (linux-aarch64-gnu), Docker Tests (ubuntu-amd64) and Docker Tests (missing-libs-debian-amd64). Each one stops at the same place:

    curl: (22) The requested URL returned error: 404
thread 'main' panicked at build.rs:263:49:
Failed to download .deb: ... "Failed to download https://archive.ubuntu.com/ubuntu/pool/main/libx/libxml2/libxml2_2.9.13+dfsg-1ubuntu0.12_amd64.deb"

    versions.env pins libxml2 2.9.13+dfsg-1ubuntu0.12. Ubuntu has since removed that build from the pool, and the current one is ...-1ubuntu0.14. So build.rs fails on any branch, including main, the next time a Linux-gnu build runs. The Cargo.lock change in #44 does not affect this path. The other 11 jobs pass, among them darwin/windows wheels, Build CLI, sdist, and Docker alpine/debian. The last green CI was #39 on 2026-09-21, when the .12 deb still existed.

    Fix (maintainer, separate from the security bundle): bump the libxml2 deb version and sha256 in versions.env to the current ubuntu0.14 build, for both the amd64 and arm64 URLs. Longer term, consider pinning to snapshot.ubuntu.com or vendoring the .deb so that archive rotation cannot break builds. The sweep is not changing it, because the safety rules forbid mixing unrelated changes into a security PR.

    🤖 Generated with Claude Code

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    dependenciesDependency updates

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions