From 17f759cf7590f35e55f4dd81d520cd550eae30b2 Mon Sep 17 00:00:00 2001 From: "Aaron K. Clark" Date: Sat, 31 Oct 2026 05:13:58 -0500 Subject: [PATCH] fix(ci): clear the three dependency advisories that turned main red (#459) The weekly scheduled runs on main failed in all three audit steps. None was a code or test failure; each was a newly published advisory against an existing dependency: - .NET: MailKit -> MimeKit pulls System.Security.Cryptography.Pkcs 10.0.0 (GHSA-846f-f764-76mx high, GHSA-2fmv-rv2c-59x7 moderate; patched in 10.0.13). The api project now carries a direct reference to 10.0.14 as a transitive floor, with a comment saying when to drop it. - Python: uv.lock moves certifi 2026.6.17 -> 2026.10.23 (PYSEC-2026-4320). - Web: package-lock.json moves follow-redirects 1.16.0 -> 1.16.2 and qs 6.15.3 -> 6.17.1 (npm audit fix). Verified locally: `dotnet list package --vulnerable --include-transitive` clean on both projects; pip-audit clean on the fresh environment and on every fork of the exported lock; `npm audit` 0 vulnerabilities; ruff/mypy/pytest green; `npm run test:web` 88 passed. Dependency-only change; no version bump, per the release convention. The patched Pkcs ships in the next tagged release. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_0124qGG2ojswVKiaTDH5SMZF --- BACKLOG.md | 1 + api/ApplyTrack.Api/ApplyTrack.Api.csproj | 5 +++++ package-lock.json | 12 ++++++------ uv.lock | 8 ++++---- 4 files changed, 16 insertions(+), 10 deletions(-) diff --git a/BACKLOG.md b/BACKLOG.md index 206d10e..4be3327 100644 --- a/BACKLOG.md +++ b/BACKLOG.md @@ -32,6 +32,7 @@ or `SPRINTS.md` are not committed backlog until they have a corresponding issue. - [x] [#345 — [SEC] Least-privilege gaps: poller as schema owner; quadlet agent as owner without hardening; table-wide agent UPDATE](https://github.com/CryptoJones/OSApplyTrack/issues/345) (fixed in 1.55.13: the poller connects as its own `applytrack_poller` role (only the tables and columns it touches; no sessions, tokens, résumés, board passwords or DDL); the api creates and re-passwords both restricted roles on boot from `AGENT_DB_PASSWORD`/`POLLER_DB_PASSWORD`; the agent's `UPDATE` on applications is column-level, never `tenant_id`/`name`; the quadlets give the agent and poller their own env files, run api/agent/poller read-only as uid 1654 with no capabilities, and publish the api on 127.0.0.1:8080 only — see deploy/quadlet/README.md for the upgrade steps) - [x] [#346 — [SEC] Hardening grab-bag: hashed session IDs, users.status, sign-out-everywhere, per-tenant LLM limit, slug validation, URL userinfo in logs](https://github.com/CryptoJones/OSApplyTrack/issues/346) (fixed in 1.56.0: sessions are stored as the SHA-256 of the cookie's id — existing rows are hashed in place, so nobody is signed out; a session slides 30 days from last use, capped at 90 from sign-in; `users.status` other than `active` stops sessions and sign-in links; `GET`/`DELETE /api/account/sessions` and Settings · Account list sessions and sign out everywhere else; the model routes are throttled per tenant as well as per IP, and `Llm__DailyCapPerTenant` (default 200) caps requests on the operator's key; Greenhouse/Lever slugs must match `[A-Za-z0-9_-]{1,100}` in both runtimes; LLM log lines carry only `scheme://host:port`) - [x] [#390 — [SEC] uv.lock pins anyio 4.14.0 — pip-audit flags three CVEs (fixed in 4.14.2)](https://github.com/CryptoJones/OSApplyTrack/issues/390) (fixed in 1.65.2: uv.lock now pins anyio 4.14.2 on Python 3.10 and 4.15.1 on 3.11+, and CI also audits the locked set — `uv export --locked`, markers stripped so every Python-version fork of the lock is checked, not just the runner's — so the lock can no longer drift vulnerable behind a clean fresh resolution) +- [x] [#459 — CI failed on main: .NET, Python and Web audit jobs](https://github.com/CryptoJones/OSApplyTrack/issues/459) (fixed on main, no release needed — the three weekly-run failures were all newly published advisories against existing dependencies, not code: MailKit → MimeKit pulled `System.Security.Cryptography.Pkcs` 10.0.0 (GHSA-846f-f764-76mx high, GHSA-2fmv-rv2c-59x7 moderate), so the api project now carries a direct reference to 10.0.14 as a transitive floor; `uv.lock` moves certifi 2026.6.17 → 2026.10.23 (PYSEC-2026-4320); `package-lock.json` moves follow-redirects 1.16.0 → 1.16.2 and qs 6.15.3 → 6.17.1 via `npm audit fix`. The patched Pkcs ships in the next tagged release) - [x] [#392 — Agent can't start Playwright as uid 1654: /app/.playwright/node/linux-x64/node is mode 744 root (breaks every packet build since the #345 units)](https://github.com/CryptoJones/OSApplyTrack/issues/392) (fixed in 1.65.3: the api image makes the Playwright driver tree readable by all and its node binary executable by all (`chmod -R a+rX /app/.playwright`), so the agent under the #345 hardening — uid 1654, read-only root, noexec `/tmp`, no capabilities — starts the driver again. Verified by driving `Playwright.CreateAsync()` → `Chromium.ConnectAsync()` → a screenshot from the image under exactly that profile: EACCES before, clean after; the driver needs nothing writable beyond `/tmp` (a read-only `$HOME` is fine). A new `image` CI job builds the api image and starts the driver that way on every PR. Deploy: pull 1.65.3 and put the agent back on `User=1654:1654`) ## Operations and scalability diff --git a/api/ApplyTrack.Api/ApplyTrack.Api.csproj b/api/ApplyTrack.Api/ApplyTrack.Api.csproj index ccb74e3..bdea08d 100644 --- a/api/ApplyTrack.Api/ApplyTrack.Api.csproj +++ b/api/ApplyTrack.Api/ApplyTrack.Api.csproj @@ -24,6 +24,11 @@ + +