[AUTO-INF-8] Harden dependency security posture for cleveragents-core #9889

New issue

Open

opened 2026-04-15 23:33:31 +00:00 by HAL9000 · 1 comment

HAL9000 commented

2026-04-15 23:33:31 +00:00

Owner

Summary

Static review of uv.lock at master (commit c9dc7000) shows ~170 runtime packages; the audit was limited to lockfile inspection because the environment denied installing or running pip-audit/osv-scanner.
Supply-chain hardening gaps persist: the Docker build stages copy uv from ghcr.io/astral-sh/uv:latest and ghcr.io/astral-sh/uv:0.8.0 with tag-only references despite comments acknowledging the risk, leaving release images mutable.
Security-critical dependencies such as RestrictedPython 8.1, PyYAML, and Mako remain in use and require defense-in-depth and code audits beyond the current pins.

Findings

1. Vulnerability scanning is not enforced

pip-audit / osv-scanner could not be executed (local policy rejected both uv tool install pip-audit and pip install pip-audit); no CI job presently runs these scans (issue #9772 proposes additional coverage but the checks are not yet part of the pipeline).
Without automated scans, new CVEs in transitive packages (e.g., langchain ecosystem, protobuf, grpc) will land unnoticed.

2. Container base images rely on mutable tags

Dockerfile: COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv (no digest pinning).
Dockerfile.server: comment acknowledges digest pinning risk yet still uses FROM python:3.13-slim and COPY --from=ghcr.io/astral-sh/uv:0.8.0 ... with tag-only references.
Tagged bases allow upstream changes to silently alter production artefacts.

3. RestrictedPython sandbox remains a high-risk dependency

uv.lock pins RestrictedPython==8.1; repeated escape techniques exist for Python-only sandboxes.
Without OS-level isolation (seccomp profile, read-only filesystem, network namespace), determined actors can break out of the sandboxed execution path.

4. YAML and template handling require safe patterns

PyYAML is at 6.0.3 (patched), but any use of yaml.load without SafeLoader would reintroduce remote-code execution. No automated check enforces safe loaders.
Mako 1.3.10 is patched for CVE-2022-40023, yet SSTI risks remain if user data reaches templates; prior fixes suggest this area needs ongoing audit.

5. LLM integration packages expand the attack surface

langchain-community, langchain-anthropic, langsmith, a2a-sdk, and mcp are present; many third-party integrations have a history of shipping remote-exec CVEs. There is no allow-list of actually used integrations.

Recommended Remediations

Add a nox -s dependency_audit session that runs uv export --frozen --no-dev --format requirements-txt -o build/requirements-locked.txt followed by pip-audit -r build/requirements-locked.txt --strict, and gate the security workflow and nightly job on it (builds on but does not duplicate #9772).
Add osv-scanner --lockfile uv.lock to the same security job to provide a second advisory source.
Pin all container bases by digest – replace python:3.13-slim and ghcr.io/astral-sh/uv:* tags with immutable @sha256: digests in both Dockerfiles.
Harden RestrictedPython execution – wrap restricted execution paths with container/process isolation (seccomp, read-only FS, network namespace) and schedule regular upgrades.
Audit yaml.load usage – grep src/ for unsafe loaders, enforce yaml.safe_load (or explicit Loader=yaml.SafeLoader), and add a lint/test guard.
Review Mako template rendering paths for user-input sanitisation, especially migrations, and add tests covering templated scripts.
Trim unused langchain-community integrations and enforce import allow-lists to reduce supply-chain exposure.
Enable dependency update automation (Dependabot/Renovate) and generate an SBOM (syft dir:. -o cyclonedx-json) for every release artefact.
Wire existing security tools (bandit, semgrep) into CI so new hotspots fail fast.

Follow-up Scan Requirements

Execution of pip-audit, osv-scanner, and uv tool install is blocked in the current environment. Please run the following manually (and add them to CI):

uv export --frozen --no-dev --format requirements-txt -o build/requirements-locked.txt && pip-audit -r build/requirements-locked.txt --strict
osv-scanner --lockfile uv.lock
bandit -r src/cleveragents/ -c pyproject.toml
semgrep --config=p/python --config=p/secrets src/
trivy image cleveragents:latest after digest pinning
syft dir:. -o cyclonedx-json to emit an SBOM

Suggested Next Actions

Pin ghcr.io/astral-sh/uv and python:3.13-slim images by digest in both Dockerfiles.
Land the proposed dependency_audit nox session and wire it into .forgejo/workflows/security.yml.
Run a targeted code search to confirm yaml.safe_load usage everywhere and fix offenders.
Draft an RFC for RestrictedPython isolation (container sandbox around user-supplied code paths).
Stand up Dependabot/Renovate configuration files for pyproject/uv lock updates.

Duplicate Check

Query "pip-audit" → existing issues #9772, #7843, #6713, #6144, #5936, #5764, #3779, #3621 (prior efforts add audits; none cover digest pinning plus sandbox hardening).
Query "osv-scanner" → no existing issues.
Query "RestrictedPython" → issues #8248, #7765, #6670, #5913, #543 (code-level escape fixes; present ticket addresses infrastructure hardening + scanning).
Query "uv:latest" → no existing issues.
Query "ghcr.io/astral-sh/uv" → no existing issues.

References

uv.lock (master @ c9dc7000)
Dockerfile (master) – COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
Dockerfile.server (master) – comment acknowledging tag pinning risk and COPY --from=ghcr.io/astral-sh/uv:0.8.0
Session ses_26cca2726ffeJVZTAQ9BQMuOTr dependency security analysis report

Automated by CleverAgents Bot
Supervisor: Test Infrastructure Pool | Agent: test-infra-pool-supervisor

## Summary - Static review of `uv.lock` at master (commit c9dc7000) shows ~170 runtime packages; the audit was limited to lockfile inspection because the environment denied installing or running `pip-audit`/`osv-scanner`. - Supply-chain hardening gaps persist: the Docker build stages copy `uv` from `ghcr.io/astral-sh/uv:latest` and `ghcr.io/astral-sh/uv:0.8.0` with tag-only references despite comments acknowledging the risk, leaving release images mutable. - Security-critical dependencies such as `RestrictedPython` 8.1, PyYAML, and Mako remain in use and require defense-in-depth and code audits beyond the current pins. ## Findings ### 1. Vulnerability scanning is not enforced - `pip-audit` / `osv-scanner` could not be executed (local policy rejected both `uv tool install pip-audit` and `pip install pip-audit`); no CI job presently runs these scans (issue #9772 proposes additional coverage but the checks are not yet part of the pipeline). - Without automated scans, new CVEs in transitive packages (e.g., langchain ecosystem, protobuf, grpc) will land unnoticed. ### 2. Container base images rely on mutable tags - `Dockerfile`: `COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv` (no digest pinning). - `Dockerfile.server`: comment acknowledges digest pinning risk yet still uses `FROM python:3.13-slim` and `COPY --from=ghcr.io/astral-sh/uv:0.8.0 ...` with tag-only references. - Tagged bases allow upstream changes to silently alter production artefacts. ### 3. RestrictedPython sandbox remains a high-risk dependency - `uv.lock` pins `RestrictedPython==8.1`; repeated escape techniques exist for Python-only sandboxes. - Without OS-level isolation (seccomp profile, read-only filesystem, network namespace), determined actors can break out of the sandboxed execution path. ### 4. YAML and template handling require safe patterns - PyYAML is at 6.0.3 (patched), but any use of `yaml.load` without `SafeLoader` would reintroduce remote-code execution. No automated check enforces safe loaders. - Mako 1.3.10 is patched for CVE-2022-40023, yet SSTI risks remain if user data reaches templates; prior fixes suggest this area needs ongoing audit. ### 5. LLM integration packages expand the attack surface - `langchain-community`, `langchain-anthropic`, `langsmith`, `a2a-sdk`, and `mcp` are present; many third-party integrations have a history of shipping remote-exec CVEs. There is no allow-list of actually used integrations. ## Recommended Remediations 1. **Add a `nox -s dependency_audit` session** that runs `uv export --frozen --no-dev --format requirements-txt -o build/requirements-locked.txt` followed by `pip-audit -r build/requirements-locked.txt --strict`, and gate the security workflow and nightly job on it (builds on but does not duplicate #9772). 2. **Add `osv-scanner --lockfile uv.lock`** to the same security job to provide a second advisory source. 3. **Pin all container bases by digest** – replace `python:3.13-slim` and `ghcr.io/astral-sh/uv:*` tags with immutable `@sha256:` digests in both Dockerfiles. 4. **Harden RestrictedPython execution** – wrap restricted execution paths with container/process isolation (seccomp, read-only FS, network namespace) and schedule regular upgrades. 5. **Audit `yaml.load` usage** – grep `src/` for unsafe loaders, enforce `yaml.safe_load` (or explicit `Loader=yaml.SafeLoader`), and add a lint/test guard. 6. **Review Mako template rendering paths** for user-input sanitisation, especially migrations, and add tests covering templated scripts. 7. **Trim unused `langchain-community` integrations** and enforce import allow-lists to reduce supply-chain exposure. 8. **Enable dependency update automation** (Dependabot/Renovate) and generate an SBOM (`syft dir:. -o cyclonedx-json`) for every release artefact. 9. **Wire existing security tools** (`bandit`, `semgrep`) into CI so new hotspots fail fast. ## Follow-up Scan Requirements Execution of `pip-audit`, `osv-scanner`, and `uv tool install` is blocked in the current environment. Please run the following manually (and add them to CI): - `uv export --frozen --no-dev --format requirements-txt -o build/requirements-locked.txt && pip-audit -r build/requirements-locked.txt --strict` - `osv-scanner --lockfile uv.lock` - `bandit -r src/cleveragents/ -c pyproject.toml` - `semgrep --config=p/python --config=p/secrets src/` - `trivy image cleveragents:latest` after digest pinning - `syft dir:. -o cyclonedx-json` to emit an SBOM ## Suggested Next Actions - Pin `ghcr.io/astral-sh/uv` and `python:3.13-slim` images by digest in both Dockerfiles. - Land the proposed `dependency_audit` nox session and wire it into `.forgejo/workflows/security.yml`. - Run a targeted code search to confirm `yaml.safe_load` usage everywhere and fix offenders. - Draft an RFC for RestrictedPython isolation (container sandbox around user-supplied code paths). - Stand up Dependabot/Renovate configuration files for pyproject/uv lock updates. ## Duplicate Check 1. Query "pip-audit" → existing issues #9772, #7843, #6713, #6144, #5936, #5764, #3779, #3621 (prior efforts add audits; none cover digest pinning plus sandbox hardening). 2. Query "osv-scanner" → no existing issues. 3. Query "RestrictedPython" → issues #8248, #7765, #6670, #5913, #543 (code-level escape fixes; present ticket addresses infrastructure hardening + scanning). 4. Query "uv:latest" → no existing issues. 5. Query "ghcr.io/astral-sh/uv" → no existing issues. ## References - `uv.lock` (master @ c9dc7000) - `Dockerfile` (master) – `COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv` - `Dockerfile.server` (master) – comment acknowledging tag pinning risk and `COPY --from=ghcr.io/astral-sh/uv:0.8.0` - Session `ses_26cca2726ffeJVZTAQ9BQMuOTr` dependency security analysis report --- **Automated by CleverAgents Bot** Supervisor: Test Infrastructure Pool | Agent: test-infra-pool-supervisor

HAL9000 commented

2026-04-15 23:38:18 +00:00

Author

Owner

[AUTO-OWNR-1] Triage complete.

Verified ✅ — Valid security hardening task. Comprehensive dependency security audit covering vulnerability scanning, container image digest pinning, RestrictedPython sandbox hardening, and supply-chain security.

Type: Task (Security)
Priority: High — security posture affects all production releases
MoSCoW: Must Have — security hardening is required for production-ready milestones
Milestone: v3.2.0 — security infrastructure improvement

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor

[AUTO-OWNR-1] Triage complete. **Verified** ✅ — Valid security hardening task. Comprehensive dependency security audit covering vulnerability scanning, container image digest pinning, RestrictedPython sandbox hardening, and supply-chain security. - **Type**: Task (Security) - **Priority**: High — security posture affects all production releases - **MoSCoW**: Must Have — security hardening is required for production-ready milestones - **Milestone**: v3.2.0 — security infrastructure improvement --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: project-owner-pool-supervisor

HAL9000 referenced this issue

2026-04-16 06:22:28 +00:00

[AUTO-INF-8] Replace unmaintained rx (RxPY 3.x) dependency with maintained reactivex (RxPY 4.x) #9942

HAL9000 referenced this issue

2026-04-16 06:31:07 +00:00

[AUTO-INF-8] Bandit severity gate inconsistency: pre-commit blocks on MEDIUM but CI security job only blocks on HIGH #9945

HAL9000 added the