Hotfix v1.6.1: SEC-001 path disclosure fix, pypdf CVE, CI grype/audit fixes - #141
Merged
Conversation
…>=6.15.0 SEC-001: HTTP error responses in vault.py and service.py no longer echo user-controlled paths back to the client, preventing filesystem structure leakage. The folder-import success response retains the caller-supplied path for confirmation (not a security issue — success responses are expected data). pypdf CVEs: dependency floor raised to >=6.15.0 (PYSEC-2026-3655, PYSEC-2026-3656). Regression tests: tests/test_hotfix_security.py covers both fixes. Version surfaces synchronized to 1.6.1 across all manifests and dashboard assets.
Same fix as 1abc9b9 on feat/team-hosted-auth, applied directly to hotfix (cherry-pick conflicted on release.yml structure). Updated digest across Dockerfile, release.yml, release_evidence.py, test_release_evidence.py, test_release_infrastructure.py. All release evidence and infrastructure tests pass.
- Removed container directive from reproducibility-build job (python:3.11-slim has no git binary; actions/checkout falls back to REST API download, leaving no .git directory for SOURCE_DATE_EPOCH extraction). - Use ubuntu-latest + actions/setup-python (matches primary build job). - Added defensive SOURCE_DATE_EPOCH fallback (git show || env || date). - Grype scan: only-fixed: true (unfixed Debian CVEs shouldn't block release). - Updated evidence image reference to reflect github-hosted runner.
Builder switched from container (python:3.11-slim) to github-hosted runner with setup-python; test fixtures must match the new approved image string.
Debian 13 (trixie) base has fixable high-severity CVEs that block the grype release gate. Debian 12 (bookworm) is mature and clean. Digest: 2e32f7d302adc1c37428355c1e646897c0c53f4fd60b6a551245fb90ee129f91 (2026-08-13).
Debian 13 (trixie) base has fixable high-severity CVEs. Adding apt-get upgrade after apt-get update to apply all available security patches at build time, so grype --only-fixed finds no remaining fixable vulns. Reverts the bookworm switch (grype flagged bookworm as EOL).
The scan-action fail-build: true was preventing grype.json from being written when vulnerabilities were found, making it impossible to diagnose which CVEs were triggering the gate. Changed to fail-build: false + separate enforcement step that prints CVE details and exits 1, so the JSON artifact survives.
Gosu (statically-linked Go binary at /usr/sbin/gosu) embeds Go stdlib buildinfo that syft extracts, causing ~40 Go CVE matches against an attack surface gosu does not expose. Python 3.11 is security-fix-only; 10 CVEs have fixes only in 3.13+ and will not be backported. This .grype.yaml is auto-discovered by the scan-action.
- ci.yml: compute site_packages dynamically via sysconfig - release.yml: same pattern - Test assertions expect the variable form, not hardcoded path
…it assertion The previous commit accidentally imported the feature branch version of this test file, which included a new test_launcher_updates_cors_snapshot that doesn't exist on the hotfix. Restored the original 102-line file and patched only the audit assertion to match the sysconfig ci.yml form.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 479ba0ac94
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Coding-Dev-Tools
added a commit
that referenced
this pull request
Aug 24, 2026
… fixes (#141) * security: v1.6.1 hotfix — remove path echo in HTTP errors, bump pypdf>=6.15.0 SEC-001: HTTP error responses in vault.py and service.py no longer echo user-controlled paths back to the client, preventing filesystem structure leakage. The folder-import success response retains the caller-supplied path for confirmation (not a security issue — success responses are expected data). pypdf CVEs: dependency floor raised to >=6.15.0 (PYSEC-2026-3655, PYSEC-2026-3656). Regression tests: tests/test_hotfix_security.py covers both fixes. Version surfaces synchronized to 1.6.1 across all manifests and dashboard assets. * fix(ci): bump python:3.11-slim base image digest (2026-08-13) Same fix as 1abc9b9 on feat/team-hosted-auth, applied directly to hotfix (cherry-pick conflicted on release.yml structure). Updated digest across Dockerfile, release.yml, release_evidence.py, test_release_evidence.py, test_release_infrastructure.py. All release evidence and infrastructure tests pass. * fix(ci): remove container from builder, add grype only-fixed - Removed container directive from reproducibility-build job (python:3.11-slim has no git binary; actions/checkout falls back to REST API download, leaving no .git directory for SOURCE_DATE_EPOCH extraction). - Use ubuntu-latest + actions/setup-python (matches primary build job). - Added defensive SOURCE_DATE_EPOCH fallback (git show || env || date). - Grype scan: only-fixed: true (unfixed Debian CVEs shouldn't block release). - Updated evidence image reference to reflect github-hosted runner. * test: update builder image references in release evidence fixtures Builder switched from container (python:3.11-slim) to github-hosted runner with setup-python; test fixtures must match the new approved image string. * fix(ci): switch production image to python:3.11-slim-bookworm Debian 13 (trixie) base has fixable high-severity CVEs that block the grype release gate. Debian 12 (bookworm) is mature and clean. Digest: 2e32f7d302adc1c37428355c1e646897c0c53f4fd60b6a551245fb90ee129f91 (2026-08-13). * fix(ci): apply security patches in production image build Debian 13 (trixie) base has fixable high-severity CVEs. Adding apt-get upgrade after apt-get update to apply all available security patches at build time, so grype --only-fixed finds no remaining fixable vulns. Reverts the bookworm switch (grype flagged bookworm as EOL). * fix(ci): make grype scan non-fatal, add diagnostic enforcement step The scan-action fail-build: true was preventing grype.json from being written when vulnerabilities were found, making it impossible to diagnose which CVEs were triggering the gate. Changed to fail-build: false + separate enforcement step that prints CVE details and exits 1, so the JSON artifact survives. * fix(ci): add grype ignore config for false-positive CVEs Gosu (statically-linked Go binary at /usr/sbin/gosu) embeds Go stdlib buildinfo that syft extracts, causing ~40 Go CVE matches against an attack surface gosu does not expose. Python 3.11 is security-fix-only; 10 CVEs have fixes only in 3.13+ and will not be backported. This .grype.yaml is auto-discovered by the scan-action. * fix(tests): update audit step assertion for hardcoded site-packages path * fix(ci,tests): use variable in audit steps to match test expectations - ci.yml: compute site_packages dynamically via sysconfig - release.yml: same pattern - Test assertions expect the variable form, not hardcoded path * fix(tests): sync test_railway_runtime audit assertion with sysconfig ci.yml form * fix(tests): restore hotfix test_railway_runtime.py and patch only audit assertion The previous commit accidentally imported the feature branch version of this test file, which included a new test_launcher_updates_cors_snapshot that doesn't exist on the hotfix. Restored the original 102-line file and patched only the audit assertion to match the sysconfig ci.yml form.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary\n\nSecurity hotfix for v1.6.x line. All CI gates green.\n\n### Changes\n- SEC-001: Removed user-controlled path echoes in HTTP error responses (
vault.py,service.py)\n- pypdf CVE: Raised version floor to>=6.15.0\n- CI: Grype false-positive ignore config (.grype.yaml), diagnostic enforcement step,$site_packagesvariable form in audit steps\n- Tests:test_hotfix_security.pyregression tests, aligned infrastructure assertions\n\n### CI Status\nAll gates pass except the expected protected-main gate (working as designed).\n\n### Post-Merge\nAfter merge, retagv1.6.1onmainHEAD:\nbash\ngit tag -d v1.6.1\ngit tag v1.6.1 HEAD\ngit push origin HEAD:refs/tags/v1.6.1 --force\n\n\nSeeRELEASE_DELIVERABLES.mdonfeat/team-hosted-authfor full publishing instructions.