From edc73f9066401a2143190da137566bfd060b3c7f Mon Sep 17 00:00:00 2001 From: vvillait88 Date: Fri, 31 Jul 2026 00:54:44 -0700 Subject: [PATCH 1/2] ci: setup-docker-builder 2.1.0, gh-action-pypi-publish 1.14.2 Both are exact pins, so dependabot proposes nothing and they only move by hand. Release notes read rather than assumed: docker-builder 2.1.0 adds agent-address discovery and a sticky-disk mount fix with no new required inputs (a major is where that risk lives); pypi-publish 1.14.2 is a dependency refresh that takes Twine 7 internally, enabling uploads carrying core packaging metadata 2.5. Every other action in the workspace was checked the same way and is current: trivy-action 0.36.0, setup-uv 9.0.0, cosign-installer 4.1.2, setup-atlas 0.3, claude-code-action 1.0.183, checkov-action 12.3114.0, and the floating majors which are current by definition. Version pins passed as workflow INPUTS, which dependabot never sees, are also current: osv-scanner 2.4.0, node 24, python 3.13. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 0267d2d..6611521 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -27,7 +27,7 @@ jobs: - run: uv build - name: Publish to PyPI - uses: pypa/gh-action-pypi-publish@v1.14.1 + uses: pypa/gh-action-pypi-publish@v1.14.2 - name: Create GitHub Release run: gh release create "$GITHUB_REF_NAME" --generate-notes From 67d8725b80e77d2af7edd7212c345a6fa480c983 Mon Sep 17 00:00:00 2001 From: vvillait88 Date: Fri, 31 Jul 2026 01:01:58 -0700 Subject: [PATCH 2/2] osv: drop the pyjwt allowlist, which no longer fires PYSEC-2025-183 was suppressed in both osv-scanner.toml and the pip-audit --ignore-vuln flags, with the two kept deliberately in sync. Re-tested by removing the suppression from each: osv-scanner reports no issues, and pip-audit run without the flag reports no known vulnerabilities. pyjwt is still in the tree at 2.13.0, so this is the advisory itself lapsing rather than the dependency leaving, which fits an entry that was recorded as disputed by upstream from the start. Dropped from both places rather than one, since a stale flag in the workflow would keep suppressing an ID nothing reports and quietly outlive the file that documents why. Overrides are audited, not permanent. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/security.yml | 7 +++---- osv-scanner.toml | 12 ------------ 2 files changed, 3 insertions(+), 16 deletions(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index e75e539..4244ab9 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -48,9 +48,8 @@ jobs: run: pip install pip-audit - name: Audit dependencies - # `--ignore-vuln` allowlist mirrors `osv-scanner.toml` (e.g. PYSEC-2025-183; - # see that file for justifications). Keep both lists in sync. + # Any `--ignore-vuln` flag here mirrors `osv-scanner.toml`; keep both + # lists in sync, and drop an entry from both once it stops firing. run: | uv export --format requirements-txt --no-hashes > requirements.txt - pip-audit -r requirements.txt --disable-pip --no-deps \ - --ignore-vuln PYSEC-2025-183 + pip-audit -r requirements.txt --disable-pip --no-deps diff --git a/osv-scanner.toml b/osv-scanner.toml index d4453f5..36fa56d 100644 --- a/osv-scanner.toml +++ b/osv-scanner.toml @@ -11,15 +11,3 @@ # ignores (e.g. disputed-by-upstream). Otherwise pick a date that forces # us to re-evaluate when the upstream releases a fix. # - `reason` — short justification - -[[IgnoredVulns]] -id = "PYSEC-2025-183" -# pyjwt 2.10.1+ flagged for "weak encryption" — disputed by upstream pyjwt -# maintainers ("the key length is chosen by the application that uses the -# library"). No fixed version exists in the advisory. pyjwt is a transitive -# of cdp-sdk (Coinbase) under the optional `coinbase` extra; merchants -# install it only when wiring the x402 Coinbase facilitator, and the JWT -# keys used in that path are user-provided. Library is library; the dispute -# is justified for our usage. Re-evaluate if upstream releases a fix. -ignoreUntil = "2027-01-01T00:00:00Z" -reason = "Disputed by pyjwt maintainers; key-length is an application-layer concern; cdp-sdk's keys are user-provided"