[AUTO-INF-4] Fortify dependency security coverage & stabilize CI runners #9772

New issue

Open

opened 2026-04-15 15:30:36 +00:00 by HAL9000 · 0 comments

HAL9000 commented

2026-04-15 15:30:36 +00:00

Owner

Summary

Verified direct dependencies in uv.lock against the PyPI advisory feed; no active CVEs detected as of 2026-04-15.
Recommend adding an automated dependency vulnerability audit alongside existing bandit/semgrep checks so future advisories fail CI before long-running jobs start.
Suggest pre-baking the Forgejo runner container with Node.js, git, Helm, and kubeconform to eliminate repeated apt-get installs that currently contribute to the 69.7% CI failure rate.

Dependency Findings

Package	Version (uv.lock)	Known Vulnerabilities	Notes
aiohttp	3.13.5	None reported (PyPI advisory feed)	Includes fix for CVE-2026-34515 (open redirect)
uvicorn	0.43.0	None reported	Latest stable as of Apr 2026
typer	0.23.1	None reported
langchain	1.2.15	None reported
httpx	0.28.1	None reported	Transport stack for SDKs
jsonschema	4.25.1	None reported
numpy	2.4.4	None reported
protobuf	6.33.6	None reported
structlog	25.5.0	None reported
a2a-sdk	0.3.25	None reported	Transitive httpx/httpx-sse pinned to patched releases

Proposed Actions

Add dependency audit to security job
- Extend nox with a dependency_audit session that runs uv export --frozen --no-dev --format requirements-txt -o build/requirements-locked.txt followed by uvx pip-audit -r build/requirements-locked.txt --strict.
- Invoke nox -s dependency_audit right after the existing security_scan step and fail on HIGH severity findings only (mirror bandit semantics).
Schedule nightly dependency scan
- In .forgejo/workflows/nightly-quality.yml, add a lightweight job that reuses the dependency_audit session so advisories raised overnight are surfaced without waiting for the next PR.
Pre-bake CI runner image
- Publish an internal image (e.g., ghcr.io/cleveragents/ci-python:3.13-uv) that already contains Node.js, git, curl/tar, Helm, and kubeconform.
- Update ci.yml jobs to reference this image and drop the repeated apt-get steps to remove a large source of runner flakes and timeouts.

CI Reliability Impact

Eliminates redundant package installations across 11 jobs, reducing network-related failures highlighted in issue #9749 (69.7% failure rate).
Fails fast on dependency advisories before expensive integration/e2e/helm jobs run, keeping master stable.

Duplicate Check

Queried GET /api/v1/repos/cleveragents/cleveragents-core/issues?state=open&limit=50&page=1 and filtered titles/bodies for "dependency"/"vulnerab" - no matches found.
No existing issues with the "[AUTO-INF-4]" tag were found.

References

pyproject.toml (master)
uv.lock (master)
PyPI advisory API responses (example: aiohttp 3.13.5)

## Summary - Verified direct dependencies in `uv.lock` against the PyPI advisory feed; no active CVEs detected as of 2026-04-15. - Recommend adding an automated dependency vulnerability audit alongside existing bandit/semgrep checks so future advisories fail CI before long-running jobs start. - Suggest pre-baking the Forgejo runner container with Node.js, git, Helm, and kubeconform to eliminate repeated apt-get installs that currently contribute to the 69.7% CI failure rate. ## Dependency Findings | Package | Version (uv.lock) | Known Vulnerabilities | Notes | | --- | --- | --- | --- | | aiohttp | 3.13.5 | None reported (PyPI advisory feed) | Includes fix for CVE-2026-34515 (open redirect) | | uvicorn | 0.43.0 | None reported | Latest stable as of Apr 2026 | | typer | 0.23.1 | None reported | | | langchain | 1.2.15 | None reported | | | httpx | 0.28.1 | None reported | Transport stack for SDKs | | jsonschema | 4.25.1 | None reported | | | numpy | 2.4.4 | None reported | | | protobuf | 6.33.6 | None reported | | | structlog | 25.5.0 | None reported | | | a2a-sdk | 0.3.25 | None reported | Transitive httpx/httpx-sse pinned to patched releases | ## Proposed Actions 1. **Add dependency audit to `security` job** - Extend `nox` with a `dependency_audit` session that runs `uv export --frozen --no-dev --format requirements-txt -o build/requirements-locked.txt` followed by `uvx pip-audit -r build/requirements-locked.txt --strict`. - Invoke `nox -s dependency_audit` right after the existing `security_scan` step and fail on HIGH severity findings only (mirror bandit semantics). 2. **Schedule nightly dependency scan** - In `.forgejo/workflows/nightly-quality.yml`, add a lightweight job that reuses the `dependency_audit` session so advisories raised overnight are surfaced without waiting for the next PR. 3. **Pre-bake CI runner image** - Publish an internal image (e.g., `ghcr.io/cleveragents/ci-python:3.13-uv`) that already contains Node.js, git, curl/tar, Helm, and kubeconform. - Update `ci.yml` jobs to reference this image and drop the repeated apt-get steps to remove a large source of runner flakes and timeouts. ## CI Reliability Impact - Eliminates redundant package installations across 11 jobs, reducing network-related failures highlighted in issue #9749 (69.7% failure rate). - Fails fast on dependency advisories before expensive integration/e2e/helm jobs run, keeping master stable. ## Duplicate Check - Queried `GET /api/v1/repos/cleveragents/cleveragents-core/issues?state=open&limit=50&page=1` and filtered titles/bodies for "dependency"/"vulnerab" - no matches found. - No existing issues with the "[AUTO-INF-4]" tag were found. ## References - [`pyproject.toml` (master)](https://git.cleverthis.com/cleveragents/cleveragents-core/src/branch/master/pyproject.toml) - [`uv.lock` (master)](https://git.cleverthis.com/cleveragents/cleveragents-core/src/branch/master/uv.lock) - PyPI advisory API responses (example: [aiohttp 3.13.5](https://pypi.org/pypi/aiohttp/3.13.5/json))

Rows
Columns