Dependency Audit red since at least 2026-08-03: cryptography, aiohttp, and a react-router advisory with no fixed release #282

New issue

Closed

opened 2026-08-05 19:48:17 +00:00 by claude-bot · 0 comments

claude-bot commented

2026-08-05 19:48:17 +00:00

Contributor

The scheduled Dependency Audit workflow has failed on main on every run since at least 2026-08-03 (runs 640, 642, 643). All three jobs fail. These are genuine CVEs, not an infrastructure problem — the log was pulled rather than guessed at.

Two are routine bumps. The third is not, and needs a decision.

1. Backend — `cryptography==48.0.1` (3 CVEs)

ID	Fixed in
PYSEC-2026-3552	50.0.0
PYSEC-2026-3553	49.0.0
PYSEC-2026-3554	49.0.0

Latest on PyPI is 50.0.0, which clears all three. Note this is a two-major jump from 48. cryptography is used directly for AES-GCM at-rest secrets encryption (webapp/backend/requirements.txt:34) and is also a transitive dependency of authlib==1.7.2, so the OIDC path needs exercising, not just the settings encryption.

2. Bot — `aiohttp==3.14.1` (3 CVEs)

ID	Fixed in
PYSEC-2026-3545	3.14.3
PYSEC-2026-3546	3.14.2
PYSEC-2026-3547	3.14.2

Latest is 3.14.3, a patch bump that clears all three. Lowest-risk of the three items.

3. Frontend — `react-router` GHSA-qwww-vcr4-c8h2 (high) — no fixed release on our line

React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response
Vulnerable range: 7.12.0 – 8.2.0

We're on react-router-dom@7.18.2, inside the range. Three things make this awkward:

npm audit fix --force proposes a downgrade to 7.11.0, flagged as breaking.
react-router-dom has no fixed version at all. Its latest dist-tag is 7.18.2 and no 8.x was ever published — in v8 the package was folded into react-router itself. The fix, react-router@8.3.0, is only reachable by migrating off react-router-dom. That is a framework migration, not a version bump.
Renovate is auto-merging within the vulnerable range. react-router-dom was bumped to 7.18.2 in b51223e four commits before this was noticed. Auto-merge is dutifully keeping us current inside a range with an unpatched high-severity advisory, and the audit job is the only thing saying so.

Applicability — probably does not affect us

The advisory is specific to RSC mode. Quest Board's frontend is a plain Vite SPA with client-side routing; there is no React Server Components setup, no server-side route module rendering, and no @vitejs/plugin-rsc. Grepping the frontend for RSC usage returns only false positives.

So the exploit path most likely does not exist here. That is a judgment about applicability, not a claim the advisory is wrong, and it should be confirmed by someone reading the advisory in full before it is acted on.

Options

Document as not-applicable and suppress, with a dated note and a recheck trigger if the frontend ever adopts RSC. Keeps the audit signal meaningful instead of permanently red.
Migrate to react-router@8.3.0 (dropping react-router-dom). Clears it properly, but it is a real migration with breaking changes across every route file.
Downgrade to 7.11.0. Clears the advisory, loses seven minor releases, and Renovate will immediately try to undo it unless pinned.

Option 1 looks right if the applicability read holds. Option 2 is the honest long-term answer and belongs in its own issue with its own testing.

Why this matters beyond the CVEs

A permanently-red scheduled job is worse than no job: it trains you to ignore the thing that would tell you about the next real vulnerability. Whatever is decided for item 3, the audit should end up green or explicitly suppressed — not left failing.

Acceptance

cryptography bumped and the full backend suite green
aiohttp bumped and the bot suite green
A decision recorded on the react-router advisory, and the audit job either green or suppressed with a dated rationale
Renovate config reviewed — auto-merge should not silently move a package deeper into a known-vulnerable range

Labels: backend, bot, frontend

The scheduled **Dependency Audit** workflow has failed on `main` on every run since at least 2026-08-03 (runs 640, 642, 643). All three jobs fail. These are genuine CVEs, not an infrastructure problem — the log was pulled rather than guessed at. Two are routine bumps. The third is not, and needs a decision. --- ## 1. Backend — `cryptography==48.0.1` (3 CVEs) | ID | Fixed in | |---|---| | PYSEC-2026-3552 | 50.0.0 | | PYSEC-2026-3553 | 49.0.0 | | PYSEC-2026-3554 | 49.0.0 | Latest on PyPI is **50.0.0**, which clears all three. Note this is a two-major jump from 48. `cryptography` is used directly for AES-GCM at-rest secrets encryption (`webapp/backend/requirements.txt:34`) and is also a transitive dependency of `authlib==1.7.2`, so the OIDC path needs exercising, not just the settings encryption. ## 2. Bot — `aiohttp==3.14.1` (3 CVEs) | ID | Fixed in | |---|---| | PYSEC-2026-3545 | 3.14.3 | | PYSEC-2026-3546 | 3.14.2 | | PYSEC-2026-3547 | 3.14.2 | Latest is **3.14.3**, a patch bump that clears all three. Lowest-risk of the three items. ## 3. Frontend — `react-router` GHSA-qwww-vcr4-c8h2 (high) — **no fixed release on our line** > React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response > Vulnerable range: `7.12.0 – 8.2.0` We're on `react-router-dom@7.18.2`, inside the range. Three things make this awkward: - **`npm audit fix --force` proposes a *downgrade* to 7.11.0**, flagged as breaking. - **`react-router-dom` has no fixed version at all.** Its `latest` dist-tag is `7.18.2` and no 8.x was ever published — in v8 the package was folded into `react-router` itself. The fix, `react-router@8.3.0`, is only reachable by migrating off `react-router-dom`. That is a framework migration, not a version bump. - **Renovate is auto-merging within the vulnerable range.** `react-router-dom` was bumped to 7.18.2 in `b51223e` four commits before this was noticed. Auto-merge is dutifully keeping us current inside a range with an unpatched high-severity advisory, and the audit job is the only thing saying so. ### Applicability — probably does not affect us The advisory is specific to **RSC mode**. Quest Board's frontend is a plain Vite SPA with client-side routing; there is no React Server Components setup, no server-side route module rendering, and no `@vitejs/plugin-rsc`. Grepping the frontend for RSC usage returns only false positives. So the exploit path most likely does not exist here. That is a judgment about applicability, not a claim the advisory is wrong, and it should be confirmed by someone reading the advisory in full before it is acted on. ### Options 1. **Document as not-applicable and suppress**, with a dated note and a recheck trigger if the frontend ever adopts RSC. Keeps the audit signal meaningful instead of permanently red. 2. **Migrate to `react-router@8.3.0`** (dropping `react-router-dom`). Clears it properly, but it is a real migration with breaking changes across every route file. 3. **Downgrade to 7.11.0.** Clears the advisory, loses seven minor releases, and Renovate will immediately try to undo it unless pinned. Option 1 looks right *if* the applicability read holds. Option 2 is the honest long-term answer and belongs in its own issue with its own testing. --- ## Why this matters beyond the CVEs A permanently-red scheduled job is worse than no job: it trains you to ignore the thing that would tell you about the next real vulnerability. Whatever is decided for item 3, the audit should end up green or explicitly suppressed — not left failing. ## Acceptance - [ ] `cryptography` bumped and the full backend suite green - [ ] `aiohttp` bumped and the bot suite green - [ ] A decision recorded on the react-router advisory, and the audit job either green or suppressed with a dated rationale - [ ] Renovate config reviewed — auto-merge should not silently move a package deeper into a known-vulnerable range Labels: backend, bot, frontend

claude-bot added the

backend

bot

frontend

labels

2026-08-05 19:48:21 +00:00