rbrooks/Quest-Board
Watch
1
0
Fork
You've already forked Quest-Board
 0
Code Issues 58 Pull requests 7 Projects Releases 76 Packages Wiki Activity Actions

fix(bot): certifi 2026.10.23 (GHSA-6q48-6c7w-9gw2), for 4.7.1 #1344

Merged
claude-bot merged 1 commit from fix/bot-certifi into main 2026-11-06 02:09:22 +00:00
Conversation 0 Commits 1 Files changed 2 +2 -1
claude-bot commented 2026-11-06 01:33:42 +00:00
Collaborator
Copy link

Closes #1343.

The only fixable HIGH or CRITICAL CVE in the published 4.7.0 images (trivy, 2026-11-06) was the bot's certifi 2025.11.12. GHSA-6q48-6c7w-9gw2 is critical: the bundle trusts emSign roots whose intermediate keys were compromised. This bumps it to 2026.10.23, the version the backend already uses. It's a transitive pin, through httpx and httpcore.

  • bot/requirements.txt: one line.
  • changelog.d/1343-bot-certifi.security.md.

Next: a 4.7.1 rc on dev, then the final, and prod on the owner's say.

🤖 Generated with Claude Code

Closes #1343. The only fixable HIGH or CRITICAL CVE in the published 4.7.0 images (trivy, 2026-11-06) was the bot's `certifi` 2025.11.12. GHSA-6q48-6c7w-9gw2 is critical: the bundle trusts emSign roots whose intermediate keys were compromised. This bumps it to 2026.10.23, the version the backend already uses. It's a transitive pin, through httpx and httpcore. - `bot/requirements.txt`: one line. - `changelog.d/1343-bot-certifi.security.md`. Next: a 4.7.1 rc on dev, then the final, and prod on the owner's say. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
fix(bot): certifi 2026.10.23 (GHSA-6q48-6c7w-9gw2)
All checks were successful
CI / Backend lint (ruff) (pull_request) Successful in 33s
Details
CI / Does this change touch the recording path? (pull_request) Successful in 19s
Details
CI / Summarisation accuracy eval harness (stub provider) (pull_request) Successful in 57s
Details
CI / Synthetic session harness (no GPU, no LLM) (pull_request) Has been skipped
Details
CI / Bot/backend version sync (pull_request) Successful in 29s
Details
CI / Which journeys does this change need? (pull_request) Successful in 21s
Details
CI / Feedback site tests (pull_request) Successful in 51s
Details
CI / Bot tests and audit (pull_request) Successful in 2m7s
Details
CI / Docker image build (pull_request) Successful in 2m36s
Details
CI / End-to-end journeys (desktop) (pull_request) Has been skipped
Details
CI / Frontend (shard 2/2) (pull_request) Successful in 17m45s
Details
CI / Frontend (shard 1/2) (pull_request) Successful in 20m25s
Details
CI / Backend migration, tests, and audit (pull_request) Successful in 34m29s
Details
69a0c16a1c 
The bot image still bundled certifi 2025.11.12, which trusts emSign
roots with compromised intermediates. It is a transitive pin (httpx,
httpcore) Renovate did not move. The backend already has 2026.10.23.

Refs #1343

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
rbrooks referenced this pull request from a commit 2026-11-06 02:10:34 +00:00
chore(release): v4.7.1-rc1
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
backend
Issue related to the backend

  
bot
Issue related to the bot

  
bug
Something is not working

  
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
frontend
Issue related to the frontend

  
help wanted
Need some help

  
invalid
Something is wrong

  
question
More information is needed

  
recording
Issue related to the recording system

  
security
Security hardening / vulnerability work

  
wontfix
This won't be fixed

No labels
backend
bot
bug
duplicate
enhancement
frontend
help wanted
invalid
question
recording
security
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
rbrooks/Quest-Board!1344
No description provided.