security posture: dependency CVEs, blind image scanning, no-op Renovate (2026-10-27 sweep) #1365

New Issue

kert · 2026-10-27T14:51:48Z

kert commented

2026-10-27 14:51:48 +00:00

Security-posture sweep, 2026-10-27. What the audit found, and what the fix branch (fix/security-posture) does about each.

Dependency CVEs

uv.lock: 32 distinct advisories (2 critical, 12 high) across aiohttp, pyjwt, urllib3, oauthlib, certifi, fsspec, multidict, opentelemetry-api. The tracker had 174 open [pkg-vuln] issues for 91 distinct titles.
docs/pnpm-lock.yaml: 116 advisories (5 critical). It had never been scanned; the nightly scan only covered uv.lock.

Scanning was blind

Harden has failed every week since 2026-09-27. quay.io/minio/mc returns 401 (MinIO archived open-source mc; dl.min.io returns 410 Gone, so no more security updates). That build aborted the job before any trivy scan ran, so no image was scanned for a month.
pkg_issues.py read only the first 50 open ci issues. Known CVEs were re-filed nightly and resolved ones never closed. A clean scan also returned before the close loop.
trivy and crane were installed from main/latest (unpinned and unverified). The from-scratch rebuild used --no-cache without --pull, so it kept stale base images.

Renovate was a no-op

28 weekly runs, all "success", zero PRs. The log says No repositories found, because RENOVATE_REPOSITORIES was never set. Its config also needed migrating, and its image floated on latest.

Images

api, llm and docs run on Debian 12 bookworm (regular security support ended 2026-06). api and llm images resolved deps at build time without --locked. The notebooks workspace has no lock at all.

Not changed (decisions for a human)

pymupdf 2.x folds in the Polyform-Noncommercial layout code plus onnxruntime, so it's held at <2.
duckdb 2.0.0 is 6 days old and blocked by the new 7-day cooldown. Renovate will raise it as a major.
Python 3.15, node 24, CUDA 12.9/13, actions/checkout v5+, React 19 and TypeScript 7: Renovate PRs, not auto-merged.
7 docs advisories remain, all build-time or dev-server-only (tinypool, serialize-javascript, uuid, body-parser). They need upstream Docusaurus bumps.

Security-posture sweep, 2026-10-27. What the audit found, and what the fix branch (`fix/security-posture`) does about each. **Dependency CVEs** - `uv.lock`: 32 distinct advisories (2 critical, 12 high) across aiohttp, pyjwt, urllib3, oauthlib, certifi, fsspec, multidict, opentelemetry-api. The tracker had 174 open `[pkg-vuln]` issues for 91 distinct titles. - `docs/pnpm-lock.yaml`: 116 advisories (5 critical). It had never been scanned; the nightly scan only covered `uv.lock`. **Scanning was blind** - Harden has failed every week since 2026-09-27. `quay.io/minio/mc` returns 401 (MinIO archived open-source mc; dl.min.io returns 410 Gone, so no more security updates). That build aborted the job before any trivy scan ran, so no image was scanned for a month. - `pkg_issues.py` read only the first 50 open `ci` issues. Known CVEs were re-filed nightly and resolved ones never closed. A clean scan also returned before the close loop. - trivy and crane were installed from `main`/`latest` (unpinned and unverified). The from-scratch rebuild used `--no-cache` without `--pull`, so it kept stale base images. **Renovate was a no-op** - 28 weekly runs, all "success", zero PRs. The log says `No repositories found`, because `RENOVATE_REPOSITORIES` was never set. Its config also needed migrating, and its image floated on `latest`. **Images** - api, llm and docs run on Debian 12 bookworm (regular security support ended 2026-06). api and llm images resolved deps at build time without `--locked`. The notebooks workspace has no lock at all. **Not changed (decisions for a human)** - pymupdf 2.x folds in the Polyform-Noncommercial layout code plus onnxruntime, so it's held at `<2`. - duckdb 2.0.0 is 6 days old and blocked by the new 7-day cooldown. Renovate will raise it as a major. - Python 3.15, node 24, CUDA 12.9/13, actions/checkout v5+, React 19 and TypeScript 7: Renovate PRs, not auto-merged. - 7 docs advisories remain, all build-time or dev-server-only (tinypool, serialize-javascript, uuid, body-parser). They need upstream Docusaurus bumps.