peter 8ffa65a9da fix(security): bump cryptography 46.0.7 -> 50.0.0 to clear 4 CVEs ...

The pip-audit step added in E1 S4 flagged cryptography 46.0.7 for PYSEC-2026-3552
/3553/3554 and GHSA-537c-gmf6-5ccf; all are fixed by 50.0.0. The requirements.txt
ceiling `<47` was blocking the upgrade — relaxed to `>=50.0.0,<51`. The lock is a
surgical bump (only the cryptography line changed; cffi 2.1.1 already satisfies
it, no other package moved). pip-audit -r requirements.lock is now clean.

Add tests/test_security.py (there was none for the crypto primitives): the
Fernet encrypt/decrypt round-trip, decrypt_optional degrading on garbage and on a
key mismatch (the B-core-2 path), and the argon2 password hash/verify round-trip
— so a future crypto-lib bump can't silently break the token-at-rest path. Gate
green: 330 pytest.

2026-08-18 02:47:05 +02:00

..

alembic

test(migrations)+fix: widen drift check to column shape; notifications.created_at NOT NULL (S2 review #2)

2026-08-18 01:39:46 +02:00

app

feat(security): add baseline security response headers (E1 S4, SEC-1)

2026-08-18 02:34:45 +02:00

tests

fix(security): bump cryptography 46.0.7 -> 50.0.0 to clear 4 CVEs

2026-08-18 02:47:05 +02:00

alembic.ini

feat: M1 foundation — compose stack, FastAPI, Google OAuth, encrypted tokens

2026-06-11 01:01:37 +02:00

docker-compose.test.yml

test(infra): fail-loud DB/ffmpeg lane + client/as_user/make_user fixtures (E1 S2, TEST-4)

2026-08-18 01:23:06 +02:00

Dockerfile

feat: M1 foundation — compose stack, FastAPI, Google OAuth, encrypted tokens

2026-06-11 01:01:37 +02:00

Dockerfile.test

build(deps): pin a reproducible lock + pip-audit; bump node 20->22 (E1 S4, SEC-5/DX-3)

2026-08-18 02:34:45 +02:00

entrypoint.sh

harden(auth): SA3 review follow-ups — IPv6-mapped match + no-proxy-headers guardrail

2026-07-12 03:49:08 +02:00

log_config.json

chore: rename remaining subfeed references to siftlode

2026-06-21 06:53:12 +02:00

pytest.ini

test(infra): fail-loud DB/ffmpeg lane + client/as_user/make_user fixtures (E1 S2, TEST-4)

2026-08-18 01:23:06 +02:00

requirements-dev.txt

test(backend): pin the traversal guard against a string-prefix bypass

2026-07-21 03:36:42 +02:00

requirements.lock

fix(security): bump cryptography 46.0.7 -> 50.0.0 to clear 4 CVEs

2026-08-18 02:47:05 +02:00

requirements.txt

fix(security): bump cryptography 46.0.7 -> 50.0.0 to clear 4 CVEs

2026-08-18 02:47:05 +02:00

ruff.toml

chore(hygiene): Phase 4 guardrails — noUnusedLocals/Parameters + dead-code sweep

2026-07-12 02:15:52 +02:00