Repository navigation
fix(desktop): bump sidecar pins for the #252 dependency audit (aiohttp, certifi, mcp, pypdf, setuptools) - #278
Conversation
…uptools The scheduled dependency audit has reported "Dependency audit failed on main" in HKUDS#252 twice since the npm half was fixed in 3d40e25, so the sidecar venv audit job is the remaining red step. Reproducing it locally with the CI-pinned pip-audit 2.10.1 found 22 known vulnerabilities in 5 packages of desktop/sidecar-requirements.lock: - aiohttp 3.14.3 -> 3.14.4 (8 advisories) - certifi 2026.6.17 -> 2026.10.23 (1 advisory) - mcp 1.29.0 -> 1.30.0 (1 advisory; the advisory also lists 2.2.0 but staying on the 1.x line keeps the diff inside the existing mcp>=1.29,<2 range declared in requirements.txt) - pypdf 6.19.0 -> 6.21.2 (11 advisories) - setuptools 83.0.0 -> 84.2.1 (1 advisory) Only the three direct pins in sidecar-requirements.in moved. The lock was regenerated with the documented command plus --upgrade-package for the two transitive packages, so yarl rides along as aiohttp's own dependency and nothing else changes. Verification: uv pip compile resolves cleanly, the rebuilt sidecar venv installs all 66 components, and desktop/scripts/audit-python-environment.py now reports "No known vulnerabilities found" instead of raising CalledProcessError. The test surfaces that touch the moved packages pass under mcp 1.30.0 and pypdf 6.21.2: 9 passed in tests/test_mcp_server.py and tests/test_mcp_oauth.py, 13 passed in tests/test_pdf_utils.py and tests/test_document_conversion.py.
|
Thank you for picking up #252 and for checking every pin against OSV, @raymondginger2018-sudo! Merged on 2026-10-27 as db40882. We verified it here: the latest scheduled run (40270120497) fails in exactly this step (22 known vulnerabilities in aiohttp, certifi, mcp, pypdf and setuptools). With your lock, pip-audit 2.10.1 finds nothing, the lock regenerates byte-for-byte with the uv command in its header, and a frozen sidecar built from it passes its own smoke test. We added cd7ab47 on top: Two small corrections for the record: run 37265722645 failed in the npm audit step, which was fixed separately, and GHSA-84m7-p3x7-pcfv is an mcp advisory (fixed in 1.30.0); yarl moves only because aiohttp 3.14.4 needs GitHub closed #252 on merge, but we've reopened it: the next audit step ( |
Summary
Fixes #252. The scheduled
Dependency and license auditjob in Security CI (run 37265722645) failed onmain. That job'sAudit locked App Server environmentstep builds the desktop sidecar venv fromdesktop/sidecar-requirements.lockand audits it; the pins it ships carried high/critical advisories. This PR takes the patched versions of the five affected packages (plus the transitiveyarlpin that follows the aiohttp bump).Changes
desktop/sidecar-requirements.in+.lock:aiohttp3.14.3 → 3.14.4 (GHSA-2g87-pp6c-29x5, GHSA-5wr8-gcqf-gqf3, GHSA-9xw5-w5jj-pvcg + 5 more)certifi2026.6.17 → 2026.10.23 (GHSA-6q48-6c7w-9gw2, critical: bundled emSign root CA with compromised intermediate keys)mcp1.29.0 → 1.30.0pypdf6.19.0 → 6.21.2 (GHSA-6c7f-9265-g8fw, GHSA-jr96-gvgh-j3r4, GHSA-gmh7-3g9r-mjh5 + 8 more)setuptools83.0.0 → 84.2.1 (GHSA-xmj3-9gf7-h52w)yarl1.24.2 → 1.25.1 (transitive aiohttp pin, GHSA-84m7-p3x7-pcfv)anthropic/httpx/openai/pydantic… unchanged: 0 advisories at current pinsTests
api.osv.dev, PyPI ecosystem): old pins → 8/2/11/1/1/1 advisories (aiohttp/certifi/pypdf/setuptools/mcp/yarl); all six new pins → 0 advisories.dependency-reviewlocal equivalent against the upstream merge-base — green (the PR's own delta introduces no advisory-flagged pins).Dependency note
npm run setup:sidecarinstalls intodesktop/build/sidecar/.venv; the bumped versions are the current patched releases of each package (no major-version jumps: aiohttp 3.14.x patch, certifi date-pin, mcp 1.x minor, pypdf 6.x minor, setuptools 84.x, yarl 1.x minor).yarlmoves together withaiohttp(declared dependency of the sidecar lock), keeping the lock internally consistent.Closes #252