Repository navigation
chore(security): ignore CVE-2026-49265 in oauthlib, which UKIP neither ships nor runs - #419
Conversation
…r ships nor runs Published 2026-09-29 and failing every PR since: a timing side channel in oauthlib's PKCE code_verifier comparison, fixed in 4.0.0. It is ignored with a disposition in SECURITY_GATES.md §7e, for two independent reasons. oauthlib is lock-only, reached through chromadb -> kubernetes -> requests-oauthlib, and a dry-run install of requirements.txt with the lock resolved 97 packages without any of them. And the flaw is in the authorization server's PKCE check; UKIP issues no OAuth codes, its SSO is an Authlib client, and nothing in backend/ imports oauthlib. Forcing a major oauthlib into the lock under a package the image does not install would buy nothing, so it waits for requests-oauthlib/kubernetes to accept 4.x; review by 2026-10-31. pip-audit 2.10.1 with the six flags: No known vulnerabilities found, 8 ignored. The same run shows the chromadb findings now emitted as PYSEC-2026-3813/3814/3815 rather than the CVE IDs the flags use, still held through aliases; recorded for the baseline review due 2026-09-30. Co-Authored-By: Claude Opus 5.5 <[email protected]>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6a05aef33c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| Re-verified with pip-audit 2.10.1: without ignores it reports the rows above; | ||
| with all six flags, `No known vulnerabilities found, 8 ignored`. It also shows | ||
| drift for the next review (2026-09-30): pip-audit now emits the three chromadb | ||
| findings as `PYSEC-2026-3813/3814/3815`, not the CVE IDs the flags use. The |
There was a problem hiding this comment.
This new verification makes §7e internally contradictory: lines 327–341 still say that the no-ignore run reports exactly five rows, that five vulnerabilities are ignored, and that every entry uses pip-audit's canonical ID, while this paragraph reports six flags/eight ignored findings and confirms that three configured IDs are now aliases. During the next exception review, operators cannot determine which output is the authoritative baseline; update or remove the stale five-entry verification and canonical-ID claim as part of this change.
Useful? React with 👍 / 👎.
CVE-2026-49265 / GHSA-xpv3-w29h-x7cv was published on 2026-09-29, and
pip-audithas failed on every PR since (#418 included). It is a timing side channel inoauthlib's PKCEcode_verifiercomparison, fixed in 4.0.0.Why it's ignored
oauthlibis lock-only, reached throughchromadb→kubernetes→requests-oauthlib. Apip install --dry-run --report -r requirements.txt -c requirements.lockresolved 97 packages without any of them. The dry-run ran on Python 3.12; the image uses 3.13.backend/importsoauthlib.The fix is a major version under a dependency the image doesn't install. It waits for
requests-oauthlib/kubernetesto accept 4.x; review by 2026-10-31.Changes
security.yml:--ignore-vuln CVE-2026-49265, with the reason inline.SECURITY_GATES.md§7e: a row plus a dated review note, per the ratchet convention. The count goes from 5 to 6.Verified
pip-audit2.10.1 with the six flags:No known vulnerabilities found, 8 ignored.PYSEC-2026-3813/3814/3815, not the CVE IDs the flags use. They are still held through aliases. This is recorded, not changed here.🤖 Generated with Claude Code