fix(security): remediate base-branch Security Scan findings (Python + npm)

[seonghobae]

Summary

Remediates every currently-failing base-branch security gate so all open PRs inherit the fix. Two independent gates were red on develop:

1. trivy-fs — Python (services/analysis-engine/uv.lock)

The job log says: "Remediate each finding at the shared base branch so open PRs inherit the fix."

• CVE-2026-59890 (MEDIUM, CVSS 6.1) — setuptools < 83.0.0: FileList applies MANIFEST.in exclude/prune globs without Unicode normalization, so an NFD file name can bypass an NFC exclusion rule on macOS APFS/HFS+. Fixed in 83.0.0.
• CVE-2026-55404 (HIGH, CVSS 7.5) — yt-dlp < 2026.7.4: --write-link/--write-url-link/--write-desktop-link write shortcut files from attacker-controlled metadata without escaping (file:// URI / desktop-entry injection). Fixed in 2026.7.4.

Direct yt-dlp floor → >=2026.7.4; transitive setuptools (via torch) pinned with a [tool.uv] constraint-dependencies entry (>=83.0.0) so it cannot regress. uv.lock: setuptools 81.0.0 → 83.0.0, yt-dlp 2026.6.9 → 2026.7.4, with torch 2.12.1 → 2.13.0 and cuda-toolkit 13.0.2 → 13.0.3.0 as transitive re-resolution.

2. security-audit — npm (package-lock.json)

npm audit --audit-level=high reported 2 high-severity transitive advisories on the base branch:

• postcss ≤ 8.5.17 (HIGH) — GHSA-r28c-9q8g-f849: path traversal in previous source-map auto-loading (sourceMappingURL) can disclose arbitrary .map files. Bump 8.5.16 → 8.5.25.
• brace-expansion ≤ 5.0.7 (HIGH) — GHSA-3jxr-9vmj-r5cp / GHSA-mh99-v99m-4gvg: DoS via exponential-time / unbounded {} expansion. Bump 5.0.6 → 5.0.8.

Applied with npm audit fix --package-lock-only (lockfile-only, semver-compatible, no package.json/overrides change; nanoid 3.3.15 → 3.3.16 pulled transitively by postcss). npm audit --audit-level=high now reports 0 vulnerabilities.

Verification

• ./scripts/harness/quickcheck.sh

Session note: the full Python suite could not run locally because the outbound proxy times out fetching the large torch/librosa wheels for uv sync. Verified without a network resolve: uv lock --locked passes (91 packages consistent), and npm audit --audit-level=high → 0 vulnerabilities. CI runs the full quickcheck plus trivy-fs, security-audit, osv-scanner, and dependency-review against this change.

Security Notes

Attack surface

Four known CVEs reachable from committed lockfiles: yt-dlp shortcut-file writing, setuptools sdist packaging, postcss source-map path traversal, brace-expansion DoS. All surface through uv.lock (trivy-fs) and package-lock.json (npm audit).

Trust boundary

Dependency supply chain only. No source-code or trust-boundary changes; fixes stay within the pinned/hash-locked lockfiles.

Mitigations

Upgrade to fixed upstream versions and record a durable setuptools>=83.0.0 floor so a future re-resolve cannot drop below the fix.

Test points

trivy-fs (0 CRITICAL/HIGH/MEDIUM), security-audit (npm audit 0 high), dependency-review, osv-scanner, and the Python engine pytest 100% coverage gate (validates the torch 2.13.0 transitive bump).

Dependency and Supply Chain

• No new direct dependency was added (yt-dlp floor moved; postcss/brace-expansion/setuptools are transitive)
• If a new dependency was added, this PR explains why it is needed
• runtime / dev / build / test classification is recorded
• alternatives were considered (per-package upgrade; a [tool.uv] constraint and --package-lock-only audit fix were chosen for a minimal, non-regressing diff)
• maintainer trust and update health were checked (upstream fixes released 2026-07)
• license fit was checked (unchanged)
• known security issues were checked (all four target CVEs resolved)
• transitive footprint impact was considered (torch/cuda-toolkit; nanoid)
• SBOM or supplemental inventory impact was recorded (lockfiles are the source of truth)

i18n impact

• No user-visible string changed
• Korean and English locale impact was updated

Reviewer checklist

• Gitflow target branch is correct (develop)
• protected-branch rules were not weakened
• required checks are expected to stay green (trivy-fs + security-audit findings resolved)

[coderabbitai]

📝 Walkthrough

Walkthrough

분석 엔진의 yt-dlp 버전을 업데이트하고, setuptools>=83.0.0을 적용하는 새로운 uv 제약 설정을 추가했습니다.

Changes

분석 엔진 의존성 설정

Layer / File(s)	Summary
의존성 버전 및 보안 제약 업데이트 services/analysis-engine/pyproject.toml	yt-dlp를 2026.7.4로 업데이트하고, CVE 관련 설명과 함께 setuptools>=83.0.0 uv 제약 조건을 추가합니다.

Estimated code review effort: 1 (Simple) | ~5 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	보안 스캔 결과를 해결하기 위한 의존성 업데이트라는 핵심 변경을 잘 요약합니다. npm 언급은 다소 넓지만 제목은 전반적으로 적절합니다.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Fix failing CI checks

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/contextualwisdomlab-audit-ci-se85n8

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Closing as closed-duplicate/superseded (security/CVE cluster) by autonomous product-completion loop.

Winner / disposition target: #727

Unique value from this cluster is consolidated there (projectId path guard + npm HIGH CVE pins + Foote novelty kernel sign). Remaining micro-duplicates do not land additional commercial readiness.

[seonghobae]

closed-closed-duplicate/superseded (security/CVE cluster) → #727