fix(deps): raise PyJWT and cryptography floors past known advisories - #162
Merged
Conversation
Scorecard's Vulnerabilities check reports seven against this repo while Dependabot reports none, because these are open floors rather than a lockfile it tracks. Six of the seven are in libraries doing security work, which is why they are worth raising rather than dismissing. PyJWT was floored at >=2.8.0. Five advisories sit above that floor and below 2.13.0 (PYSEC-2026-120, -175, -177, -178, -179), plus PYSEC-2025-183 / CVE-2025-45768 on weak encryption at 2.10.1 and below. That last one is disputed by the maintainer on the grounds that key length is the caller's choice; the floor covers it either way. cryptography was floored at >=42.0.0. PYSEC-2026-3552 is a Bleichenbacher oracle: PKCS#7 EnvelopedData decryption exposes distinguishable errors. Fixed in 50.0.0, which is also what cmcp already requires, so this brings the repo in line rather than ahead. A floor raise, not a pin: pip already resolves to current versions today. What this removes is a resolution that could legally pick a vulnerable one, which is exactly what an open floor on a JWT library should not permit. comply54 declares both in pyproject.toml and requirements.txt; sentinel declares both in requirements.txt. ramen-ai-cmcp already pins cryptography==50.0.1 and needed nothing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XbDBXDWWvMFa7c2jGgyq9t
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the seven advisories OpenSSF Scorecard reports against this repo. Dependabot reports none of them, because these are open floors in
pyproject.toml/requirements.txtrather than a lockfile it tracks.Six of the seven are in libraries doing security work, which is why these are worth raising rather than dismissing.
PyJWT, floored at
>=2.8.0That last one is disputed by the maintainer, on the grounds that key length is chosen by the calling application rather than the library. Worth knowing rather than citing as a straight vulnerability; the floor covers it either way.
cryptography, floored at
>=42.0.0PYSEC-2026-3552: PKCS#7
EnvelopedDatadecryption exposes a Bleichenbacher oracle through distinguishable errors. Fixed in 50.0.0, which is also whatcmcpalready requires, so this brings the repo in line with the org rather than ahead of it.Scope
This is a floor raise, not a pin. pip already resolves to current versions today, so nothing about a fresh install changes. What it removes is a resolution that could legally pick a vulnerable version — which is exactly what an open floor on a JWT library should not permit.
integrations/comply54: both, inpyproject.tomlandrequirements.txtintegrations/sentinel: both, inrequirements.txtintegrations/ramen-ai-cmcp: already pinscryptography==50.0.1, unchanged🤖 Generated with Claude Code
https://claude.ai/code/session_01XbDBXDWWvMFa7c2jGgyq9t