peter
b1ff4058ac
The server gate adds `vite build` (and with it devOnlyGuard, which until now first ran inside the image build, after main was pushed) and `npm audit --omit=dev --audit-level=high`. pip-audit is blocking: when it was finally read it held three urllib3 advisories with a fix available. urllib3 goes 2.7.0 -> 2.8.0 as a single in-place pin, passing pip check, rather than a regeneration that would move every package. The dev toolchain's 18 advisories are gone: - vite 5 -> 6.4.3 (path traversal, fs.deny bypass, and esbuild <= 0.24.2 through it); - vitest 3 -> 4.1.11 (mocker path traversal); - typescript-eslint 8.46 -> 8.71; - `npm audit fix` for the rest. tsc, eslint, knip, all 2269 tests and the build pass unchanged. scripts/check-node-modules.mjs checks that frontend/node_modules holds exactly what package-lock.json pins. The local gate's frontend lanes judge the host tree, and nothing tied it to the lock the image installs.
66 lines
1.7 KiB
Plaintext
66 lines
1.7 KiB
Plaintext
# Pinned dependency lock for reproducible builds (SEC-5). GENERATED — do not hand-edit.
|
|
# Source of truth is requirements.txt (the floor ranges); regenerate after editing it with:
|
|
# docker run --rm -v "$PWD":/b python:3.12-slim sh -c 'pip install -q -r /b/requirements.txt && pip freeze --exclude pip --exclude setuptools --exclude wheel' | sort
|
|
# The prod Dockerfile + Dockerfile.test + CI install THIS file; pip-audit scans it in CI (blocking
|
|
# since E32). A security fix may be ONE pin bumped in place instead of a full regeneration, which
|
|
# would move every other package too — then `pip install -r requirements.lock && pip check` must
|
|
# pass. In place so far: urllib3 2.7.0 -> 2.8.0 (PYSEC-2026-4175/4176/4177, E32).
|
|
APScheduler==3.11.3
|
|
Authlib==1.7.2
|
|
Mako==1.4.1
|
|
MarkupSafe==3.0.3
|
|
PyYAML==6.0.3
|
|
Pygments==2.21.0
|
|
SQLAlchemy==2.0.52
|
|
alembic==1.19.1
|
|
annotated-doc==0.0.5
|
|
annotated-types==0.8.0
|
|
anyio==4.14.2
|
|
argon2-cffi-bindings==25.1.0
|
|
argon2-cffi==25.1.0
|
|
bgutil-ytdlp-pot-provider==1.3.1
|
|
brotli==1.2.0
|
|
certifi==2026.7.22
|
|
cffi==2.1.1
|
|
charset-normalizer==3.5.1
|
|
click==8.4.2
|
|
cryptography==50.0.0
|
|
curl_cffi==0.15.0
|
|
fastapi==0.141.1
|
|
feedparser-sgmllib==2.1.0
|
|
feedparser==6.0.14
|
|
greenlet==3.5.5
|
|
h11==0.16.0
|
|
httpcore==1.0.9
|
|
httptools==0.8.0
|
|
httpx==0.28.1
|
|
idna==3.18
|
|
itsdangerous==2.2.0
|
|
joserfc==1.7.4
|
|
markdown-it-py==4.2.0
|
|
mdurl==0.1.2
|
|
mutagen==1.48.1
|
|
numpy==2.5.2
|
|
psycopg-binary==3.3.4
|
|
psycopg==3.3.4
|
|
py3langid==0.3.0
|
|
pycparser==3.0
|
|
pycryptodomex==3.23.0
|
|
pydantic-settings==2.15.0
|
|
pydantic==2.13.4
|
|
pydantic_core==2.46.4
|
|
python-dotenv==1.2.3
|
|
requests==2.34.2
|
|
rich==15.0.0
|
|
starlette==1.6.0
|
|
typing-inspection==0.4.4
|
|
typing_extensions==4.16.0
|
|
tzlocal==5.4.4
|
|
urllib3==2.8.0
|
|
uvicorn==0.52.3
|
|
uvloop==0.22.1
|
|
watchfiles==1.2.0
|
|
websockets==17.0.1
|
|
yt-dlp-ejs==0.8.0
|
|
yt-dlp==2026.7.4
|