SEC2-063: The dev lock pins a core commit 210 behind and carries pyjwt 2.13.0 and urllib3 2.7.0 with published advisories #17

New issue

Closed

opened 2026-10-17 10:39:55 +00:00 by tiagoagueda · 0 comments

tiagoagueda commented

2026-10-17 10:39:55 +00:00

Owner

Found on 2026-10-16 in a read-only security review of postulo-paperless at 37a044b, checked by a second, independent pass.

Severity: Low · Category: Dependencies · Reference: CWE-1395 (Dependency on Vulnerable Third-Party Component); OWASP A06:2021 (Vulnerable and Outdated Components)

Location:

pyproject.toml:55 (postulo @ git+...@925e3e9cd, dev group)
pyproject.toml:51-53 (the comment still says the pin is to become @v0.3.0)
uv.lock:834-836, and the lock's pyjwt 2.13.0, urllib3 2.7.0, oauthlib 3.3.1

Issue

pip-audit 2.10.1, run on 2026-10-16 against uv export of the lock, finds 19 known
vulnerabilities in 3 packages: pyjwt 2.13.0 (fourteen advisories, PYSEC-2026-4140 to -4152 and
-4183, fixed in 2.14.0 / 2.15.0), urllib3 2.7.0 (PYSEC-2026-4175, -4176, -4177, fixed in 2.8.0)
and oauthlib 3.3.1 (PYSEC-2026-4114, fixed in 4.0.0). All three arrive through the pinned core,
which at 56fc9d531 holds pyjwt 2.15.1 and urllib3 2.8.0. httpx, the plugin's own dependency,
is clean. The pin is 210 commits behind the core, and the comment promising @v0.3.0 no longer
matches a lock that resolves postulo 0.4.0.

Impact

CI and developer environments only: an instance installs the plugin as a wheel under the core's
lock as a constraint and receives the core's versions.

Fix

Repin the dev group to the current core and run uv lock --upgrade-package pyjwt --upgrade-package urllib3; drop or honour the @v0.3.0 comment. Add the audit job
postulo/postulo-apprise#13 asks for, so the next drift is reported.

Done when: pip-audit --strict over uv export --no-emit-project of this lock finds nothing the
core's own lock does not carry.

postulo/postulo-apprise#13 (open) names this repository for the missing uv pin and audit job but
records no advisory. #2 (closed) set the pin once; it has slipped since.

Found on 2026-10-16 in a read-only security review of `postulo-paperless` at `37a044b`, checked by a second, independent pass. **Severity:** Low · **Category:** Dependencies · **Reference:** CWE-1395 (Dependency on Vulnerable Third-Party Component); OWASP A06:2021 (Vulnerable and Outdated Components) **Location:** - `pyproject.toml:55` (`postulo @ git+...@925e3e9cd`, dev group) - `pyproject.toml:51-53` (the comment still says the pin is to become `@v0.3.0`) - `uv.lock:834-836`, and the lock's `pyjwt` 2.13.0, `urllib3` 2.7.0, `oauthlib` 3.3.1 ## Issue pip-audit 2.10.1, run on 2026-10-16 against `uv export` of the lock, finds 19 known vulnerabilities in 3 packages: pyjwt 2.13.0 (fourteen advisories, PYSEC-2026-4140 to -4152 and -4183, fixed in 2.14.0 / 2.15.0), urllib3 2.7.0 (PYSEC-2026-4175, -4176, -4177, fixed in 2.8.0) and oauthlib 3.3.1 (PYSEC-2026-4114, fixed in 4.0.0). All three arrive through the pinned core, which at `56fc9d531` holds pyjwt 2.15.1 and urllib3 2.8.0. `httpx`, the plugin's own dependency, is clean. The pin is 210 commits behind the core, and the comment promising `@v0.3.0` no longer matches a lock that resolves postulo 0.4.0. ## Impact CI and developer environments only: an instance installs the plugin as a wheel under the core's lock as a constraint and receives the core's versions. ## Fix Repin the dev group to the current core and run `uv lock --upgrade-package pyjwt --upgrade-package urllib3`; drop or honour the `@v0.3.0` comment. Add the audit job postulo/postulo-apprise#13 asks for, so the next drift is reported. Done when: `pip-audit --strict` over `uv export --no-emit-project` of this lock finds nothing the core's own lock does not carry. ## Related postulo/postulo-apprise#13 (open) names this repository for the missing uv pin and audit job but records no advisory. #2 (closed) set the pin once; it has slipped since.

tiagoagueda added the

bug

security

labels

2026-10-17 10:39:55 +00:00

tiagoagueda referenced this issue from Postulo/postulo

2026-10-17 10:41:23 +00:00

SEC2 index: security review of 2026-10-16 (86 issues across the core, plugins and extensions) #992

tiagoagueda referenced this issue from a commit

2026-10-19 07:05:31 +00:00

Repin the dev lock to the current core, pin the uv installer and audit the lock in CI

tiagoagueda referenced this issue