fix(security): remediate base-branch supply-chain CVEs (setuptools, brace-expansion, postcss) by seonghobae · Pull Request #718 · ContextualWisdomLab/bandscope

seonghobae · 2026-07-29T22:29:22Z

Pull Request

Summary

Remediates the real Medium+ supply-chain findings that fail the trivy-fs and security-audit required gates on develop, fixed at the base branch so every open PR inherits the fix. Findings were confirmed from CI job logs (PR #715 trivy-fs + security-audit), not from PR titles — the suspected yt-dlp / sharp CVEs are already remediated on base (yt-dlp>=2026.6.9, no sharp finding).

CVE/GHSA → fixed version:

setuptools CVE-2026-59890 (MEDIUM, CVSS 6.1 — FileList Unicode-normalization exclusion bypass): 81.0.0 → 83.0.0. Transitive via torch. torch 2.12.1 caps setuptools<82, so torch moves 2.12.1 → 2.13.0 (requires setuptools>=77.0.3, no upper bound) to allow the patched line; its cuda-toolkit transitive follows (13.0.2 → 13.0.3.0). Pinned durably via [tool.uv] constraint-dependencies = ["setuptools>=83.0.0"] and re-locked with uv lock --upgrade-package setuptools.
brace-expansion GHSA-3jxr-9vmj-r5cp + GHSA-mh99-v99m-4gvg (HIGH — ReDoS / unbounded-expansion OOM): 5.0.6 → 5.0.8.
postcss GHSA-r28c-9q8g-f849 (HIGH — source-map path traversal / arbitrary .map disclosure): 8.5.16 → 8.5.18.

Both npm fixes are pinned via scoped root overrides (same-major/minor patch bumps only — no export-shape change), with a minimal hand-applied package-lock.json edit to avoid full-tree churn. No security gate was weakened and no broad ignores were added.

Verification

./scripts/harness/quickcheck.sh — ran its constituent gates individually (see below) plus the security-audit workflow commands

Local results (all pass):

npm ci: lockfile consistent with package.json
npm audit --workspaces --audit-level=high: found 0 vulnerabilities
npm run build / test / lint / typecheck: pass (desktop + shared-types 100% coverage, mypy --strict clean)
uv sync --project services/analysis-engine --group dev --frozen: ok
uv run … pip-audit --local --strict: No known vulnerabilities found
analysis-engine pytest --cov … --cov-fail-under=100: 657 passed, 24 skipped, 100% coverage
trivy not installed locally; the sole trivy-fs finding was setuptools and is now patched, corroborated by the clean pip-audit

Security Notes

Attack surface

Dependency supply chain only (build/dev tooling + Python analysis engine deps). No application source, IPC boundary, or runtime behaviour changed.

Trust boundary

No trust boundary moved. postcss/brace-expansion are dev-time build/lint tooling; setuptools/torch are analysis-engine deps behind the existing Tauri→subprocess boundary.

Mitigations

Upgraded each vulnerable package to its patched release. Fixes are pinned (npm overrides, uv constraint-dependencies) so a future lock refresh cannot silently regress below the patched line.

Test points

npm audit, pip-audit, and the full build/test/lint/typecheck matrix all run clean on the patched locks; analysis-engine tests keep 100% coverage with torch 2.13.0 (tests use fake torch/demucs; real torch is lazily imported only in the separation code path).

Dependency and Supply Chain

No new direct dependency was added (only transitive-version pins via overrides / constraint-dependencies)
If a new dependency was added, this PR explains why it is needed
runtime / dev / build / test classification is recorded (postcss/brace-expansion = dev/build tooling; setuptools/torch = analysis-engine runtime transitives)
alternatives were considered (npm audit fix ballooned the tree and could not resolve within-range; scoped overrides + surgical lock edit chosen for a minimal, auditable diff)
maintainer trust and update health were checked (all official upstreams; patch/minor bumps)
license fit was checked (no license change)
known security issues were checked (npm audit + pip-audit clean post-fix)
transitive footprint impact was considered (uv.lock change confined to the torch subtree; npm diff limited to the two packages)
SBOM or supplemental inventory impact was recorded (version bumps only; no packages added/removed)

i18n impact

No user-visible string changed
Korean and English locale impact was updated

Reviewer checklist

Gitflow target branch is correct (develop)
protected-branch rules were not weakened
required checks are expected to stay green

Generated by Claude Code

Fixes the real Medium+ findings failing the `trivy-fs` and `security-audit` gates on develop, at the base branch so open PRs inherit the fix. Confirmed from CI job logs (PR #715 checks), not from PR titles — the suspected yt-dlp / sharp CVEs are already remediated on base (`yt-dlp>=2026.6.9`). Findings remediated (CVE/GHSA -> fixed version): - setuptools CVE-2026-59890 (MEDIUM 6.1, FileList Unicode-normalization exclusion bypass): 81.0.0 -> 83.0.0. Transitive via torch; torch 2.12.1 caps `setuptools<82`, so torch is bumped 2.12.1 -> 2.13.0 (requires `setuptools>=77.0.3`, no upper bound) to allow the patched line. Constrained durably in pyproject `[tool.uv] constraint-dependencies` and re-locked with `uv lock --upgrade-package setuptools`. - brace-expansion GHSA-3jxr-9vmj-r5cp + GHSA-mh99-v99m-4gvg (HIGH, ReDoS / unbounded-expansion OOM): 5.0.6 -> 5.0.8. - postcss GHSA-r28c-9q8g-f849 (HIGH, source-map path traversal): 8.5.16 -> 8.5.18. Both npm fixes pinned via scoped root `overrides` (same-major/minor patch bumps only; no export-shape change) with a minimal hand-applied lockfile edit, avoiding full-tree churn. Local verification (all pass): - npm ci: lock consistent with package.json - npm audit --workspaces --audit-level=high: found 0 vulnerabilities - npm run build / test / lint / typecheck: pass (desktop + shared-types 100% cov) - uv sync --project services/analysis-engine --group dev --frozen: ok - pip-audit --local --strict: No known vulnerabilities found - analysis-engine pytest: 657 passed, 24 skipped, 100% coverage - (trivy not installed locally; sole trivy-fs finding was setuptools, now patched and corroborated by clean pip-audit) No security gate weakened; no broad ignores added. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AzUnTqFnQqhRbaopvDdag7

coderabbitai · 2026-07-29T22:29:33Z

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 8 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f2551fc8-cf4f-4b9b-8399-dce32b94b9f5

📥 Commits

Reviewing files that changed from the base of the PR and between f8343f5 and 8901f28.

⛔ Files ignored due to path filters (2)

package-lock.json is excluded by !**/package-lock.json
services/analysis-engine/uv.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

package.json
services/analysis-engine/pyproject.toml

_{Comment @coderabbitai help to get the list of available commands.}

trivy-fs on the branch head flagged one remaining Medium+ finding (setuptools was cleared and the torch/cuda cascade introduced none): yt-dlp CVE-2026-55404 (HIGH, CVSS 7.5 — .url/.desktop shortcut-file injection via attacker-controlled webpage_url/filename in --write-link/--write-url-link/ --write-desktop-link, leading to downstream RCE if the shortcut is opened). This advisory postdates the PR #715 scan, so the trivy DB now matches the pinned yt-dlp 2026.6.9; the fix is 2026.7.4. yt-dlp is a direct dependency: bumped the floor `>=2026.6.9` -> `>=2026.7.4` in services/analysis-engine/pyproject.toml and re-locked surgically with `uv lock --upgrade-package yt-dlp` (only yt-dlp changed: 2026.6.9 -> 2026.7.4). Local verification (all pass): - uv sync --project services/analysis-engine --group dev --frozen: ok - pip-audit --local --strict: No known vulnerabilities found - analysis-engine pytest --cov --cov-fail-under=100: 657 passed, 24 skipped, 100% - npm ci consistent; npm audit --workspaces --audit-level=high: 0 vulnerabilities - npm run build / test / lint / typecheck: pass (desktop 194 tests + shared-types 20 tests, 100% coverage; mypy --strict clean; supply-chain/doc/bandit gates green) - trivy not installed locally; yt-dlp is now 2026.7.4, exactly the fixed version trivy demanded, corroborated by clean pip-audit No security gate weakened; no ignores added. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AzUnTqFnQqhRbaopvDdag7

seonghobae · 2026-07-31T12:51:57Z

Closing as closed-duplicate/superseded (security/CVE cluster) by autonomous product-completion loop.

Winner / disposition target: #727

Unique value from this cluster is consolidated there (projectId path guard + npm HIGH CVE pins + Foote novelty kernel sign). Remaining micro-duplicates do not land additional commercial readiness.

seonghobae · 2026-07-31T12:51:58Z

closed-closed-duplicate/superseded (security/CVE cluster) → #727

seonghobae mentioned this pull request Jul 31, 2026

fix(security): projectId path guard, npm HIGH CVEs, Foote novelty sign #727

Merged

3 tasks

seonghobae closed this Jul 31, 2026

Navigation Menu

Uh oh!

fix(security): remediate base-branch supply-chain CVEs (setuptools, brace-expansion, postcss) - #718

fix(security): remediate base-branch supply-chain CVEs (setuptools, brace-expansion, postcss)#718
seonghobae wants to merge 2 commits into
developfrom
claude/contextualwisdomlab-audit-governance-btqxja

seonghobae commented Jul 29, 2026

Uh oh!

coderabbitai Bot commented Jul 29, 2026 •

edited

Loading

Review limit reached

Uh oh!

seonghobae commented Jul 31, 2026

Uh oh!

seonghobae commented Jul 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

seonghobae commented Jul 29, 2026

Pull Request

Summary

Verification

Security Notes

Attack surface

Trust boundary

Mitigations

Test points

Dependency and Supply Chain

i18n impact

Reviewer checklist

Uh oh!

coderabbitai Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

seonghobae commented Jul 31, 2026

Uh oh!

seonghobae commented Jul 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai Bot commented Jul 29, 2026 •

edited

Loading