SEC2-065: The dev lock pins a core commit 211 behind and carries pyjwt 2.13.0 and urllib3 2.7.0 with published advisories #14

New issue

Closed

opened 2026-10-17 10:39:57 +00:00 by tiagoagueda · 0 comments

tiagoagueda commented

2026-10-17 10:39:57 +00:00

Owner

Found on 2026-10-16 in a read-only security review of postulo-helloworld at 6afab68, checked by a second, independent pass.

Severity: Low · Category: Dependencies · Reference: CWE-1395 (Dependency on Vulnerable Third-Party Component); OWASP A06:2021 (Vulnerable and Outdated Components)

Location:

pyproject.toml:50 (postulo pinned at e014152fc, dev group)
uv.lock (the lock's pyjwt 2.13.0, urllib3 2.7.0, oauthlib 3.3.1)

Issue

pip-audit 2.10.1, run on 2026-10-16 against uv export of the lock, reports pyjwt 2.13.0
(fourteen advisories, PYSEC-2026-4140 to -4152 and -4183, fixed in 2.14.0 / 2.15.0), urllib3
2.7.0 (PYSEC-2026-4175, -4176, -4177, fixed in 2.8.0) and oauthlib 3.3.1 (PYSEC-2026-4114). All
three come through the pinned core, which at 56fc9d531 holds pyjwt 2.15.1 and urllib3 2.8.0.
The plugin itself depends on nothing.

Impact

CI and developer environments only; an instance receives the core's versions through the
constraint it installs plugins under.

Fix

Repin the dev group to the current core and run uv lock --upgrade-package pyjwt --upgrade-package urllib3; add the audit job postulo/postulo-apprise#13 asks for.

Done when: pip-audit --strict over uv export --no-emit-project of this lock finds nothing the
core's own lock does not carry.

postulo/postulo-apprise#13 (open) names this repository for the missing uv pin and audit job,
with no advisory recorded. #11 (open) is about the release gate not running, not the pin.

Found on 2026-10-16 in a read-only security review of `postulo-helloworld` at `6afab68`, checked by a second, independent pass. **Severity:** Low · **Category:** Dependencies · **Reference:** CWE-1395 (Dependency on Vulnerable Third-Party Component); OWASP A06:2021 (Vulnerable and Outdated Components) **Location:** - `pyproject.toml:50` (`postulo` pinned at `e014152fc`, dev group) - `uv.lock` (the lock's `pyjwt` 2.13.0, `urllib3` 2.7.0, `oauthlib` 3.3.1) ## Issue pip-audit 2.10.1, run on 2026-10-16 against `uv export` of the lock, reports pyjwt 2.13.0 (fourteen advisories, PYSEC-2026-4140 to -4152 and -4183, fixed in 2.14.0 / 2.15.0), urllib3 2.7.0 (PYSEC-2026-4175, -4176, -4177, fixed in 2.8.0) and oauthlib 3.3.1 (PYSEC-2026-4114). All three come through the pinned core, which at `56fc9d531` holds pyjwt 2.15.1 and urllib3 2.8.0. The plugin itself depends on nothing. ## Impact CI and developer environments only; an instance receives the core's versions through the constraint it installs plugins under. ## Fix Repin the dev group to the current core and run `uv lock --upgrade-package pyjwt --upgrade-package urllib3`; add the audit job postulo/postulo-apprise#13 asks for. Done when: `pip-audit --strict` over `uv export --no-emit-project` of this lock finds nothing the core's own lock does not carry. ## Related postulo/postulo-apprise#13 (open) names this repository for the missing uv pin and audit job, with no advisory recorded. #11 (open) is about the release gate not running, not the pin.

tiagoagueda added the

bug

security

labels

2026-10-17 10:39:58 +00:00

tiagoagueda referenced this issue from Postulo/postulo

2026-10-17 10:41:23 +00:00

SEC2 index: security review of 2026-10-16 (86 issues across the core, plugins and extensions) #992

tiagoagueda referenced this issue from a commit

2026-10-19 07:08:42 +00:00

Repin the dev lock to the current core, pin the uv installer and audit the lock in CI

tiagoagueda referenced this issue