fix(deps): raise parser and TestClient security floors - #822
Conversation
🚨 Severity: MEDIUM 💡 Vulnerability: /parse 엔드포인트의 language 및 mode Form 필드에 최대 길이(max_length) 제한이 설정되어 있지 않았습니다. 🎯 Impact: python-multipart가 폼 데이터를 메모리에 로드하므로, 악의적인 사용자가 매우 긴 문자열을 전송하여 메모리 고갈(OOM)을 통한 서비스 거부(DoS) 공격을 유발할 수 있습니다. 🔧 Fix: FastAPI의 Form 필드에 max_length=50 제약 조건을 명시적으로 추가했습니다. ✅ Verification: 비정상적으로 긴 폼 데이터를 전송했을 때 HTTP 422 응답이 반환되는지 확인하는 테스트 코드를 추가하고 테스트 스위트를 통과했습니다.
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
📝 WalkthroughWalkthroughpypdf 최소 버전이 Changes의존성 보안 기준
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Merge Risk: 🔵 Low · up to This change raises the pypdf security floor and records the patched lock version, but its release documentation identifies an older candidate commit and some regression tests could allow security-documentation or lock-floor regressions. Update the SHA and test assertions before merging. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🚨 Severity: MEDIUM 💡 Vulnerability: /parse 엔드포인트의 language 및 mode Form 필드에 최대 길이(max_length) 제한이 설정되어 있지 않았습니다. 🎯 Impact: python-multipart가 폼 데이터를 메모리에 로드하므로, 악의적인 사용자가 매우 긴 문자열을 전송하여 메모리 고갈(OOM)을 통한 서비스 거부(DoS) 공격을 유발할 수 있습니다. 🔧 Fix: FastAPI의 Form 필드에 max_length=50 제약 조건을 명시적으로 추가했습니다. ✅ Verification: 비정상적으로 긴 폼 데이터를 전송했을 때 HTTP 422 응답이 반환되는지 확인하는 테스트 코드를 추가하고 테스트 스위트를 통과했습니다.
seonghobae
changed the title
🚨 Severity: MEDIUM 💡 Vulnerability: /parse 엔드포인트의 language 및 mode Form 필드에 최대 길이(max_length) 제한이 설정되어 있지 않았습니다. 🎯 Impact: python-multipart가 폼 데이터를 메모리에 로드하므로, 악의적인 사용자가 매우 긴 문자열을 전송하여 메모리 고갈(OOM)을 통한 서비스 거부(DoS) 공격을 유발할 수 있습니다. 🔧 Fix: FastAPI의 Form 필드에 max_length=50 제약 조건을 명시적으로 추가했습니다. ✅ Verification: 비정상적으로 긴 폼 데이터를 전송했을 때 HTTP 422 응답이 반환되는지 확인하는 테스트 코드를 추가하고 테스트 스위트를 통과했습니다.
🚨 Severity: MEDIUM 💡 Vulnerability: /parse 엔드포인트의 language 및 mode Form 필드에 최대 길이(max_length) 제한이 설정되어 있지 않았습니다. 🎯 Impact: python-multipart가 폼 데이터를 메모리에 로드하므로, 악의적인 사용자가 매우 긴 문자열을 전송하여 메모리 고갈(OOM)을 통한 서비스 거부(DoS) 공격을 유발할 수 있습니다. 🔧 Fix: FastAPI의 Form 필드에 max_length=50 제약 조건을 명시적으로 추가했습니다. ✅ Verification: 비정상적으로 긴 폼 데이터를 전송했을 때 HTTP 422 응답이 반환되는지 확인하는 테스트 코드를 추가하고 테스트 스위트를 통과했습니다.
|
@jules Current exact RCA: the declared Minimal causal GREEN:
Primary upstream references: NIST currently still lists SP 800-218 Rev.1 / SSDF 1.2 as Draft (published 2025-12-17), so the doctoring record may keep SSDF 1.1 as normative and 1.2 as informative, but should use the current publication date/status rather than the older 2025 wording. |
🚨 Severity: MEDIUM 💡 Vulnerability: /parse 엔드포인트의 language 및 mode Form 필드에 최대 길이(max_length) 제한이 설정되어 있지 않았습니다. 🎯 Impact: python-multipart가 폼 데이터를 메모리에 로드하므로, 악의적인 사용자가 매우 긴 문자열을 전송하여 메모리 고갈(OOM)을 통한 서비스 거부(DoS) 공격을 유발할 수 있습니다. 🔧 Fix: FastAPI의 Form 필드에 max_length=50 제약 조건을 명시적으로 추가했습니다. ✅ Verification: 비정상적으로 긴 폼 데이터를 전송했을 때 HTTP 422 응답이 반환되는지 확인하는 테스트 코드를 추가하고 테스트 스위트를 통과했습니다.
🚨 Severity: MEDIUM 💡 Vulnerability: /parse 엔드포인트의 language 및 mode Form 필드에 최대 길이(max_length) 제한이 설정되어 있지 않았습니다. 🎯 Impact: python-multipart가 폼 데이터를 메모리에 로드하므로, 악의적인 사용자가 매우 긴 문자열을 전송하여 메모리 고갈(OOM)을 통한 서비스 거부(DoS) 공격을 유발할 수 있습니다. 🔧 Fix: FastAPI의 Form 필드에 max_length=50 제약 조건을 명시적으로 추가했습니다. ✅ Verification: 비정상적으로 긴 폼 데이터를 전송했을 때 HTTP 422 응답이 반환되는지 확인하는 테스트 코드를 추가하고 테스트 스위트를 통과했습니다.
seonghobae
added
bug
ChatGPT Codex Connector
🚨 Severity: MEDIUM 💡 Vulnerability: /parse 엔드포인트의 language 및 mode Form 필드에 최대 길이(max_length) 제한이 설정되어 있지 않았습니다. 🎯 Impact: python-multipart가 폼 데이터를 메모리에 로드하므로, 악의적인 사용자가 매우 긴 문자열을 전송하여 메모리 고갈(OOM)을 통한 서비스 거부(DoS) 공격을 유발할 수 있습니다. 🔧 Fix: FastAPI의 Form 필드에 max_length=50 제약 조건을 명시적으로 추가했습니다. ✅ Verification: 비정상적으로 긴 폼 데이터를 전송했을 때 HTTP 422 응답이 반환되는지 확인하는 테스트 코드를 추가하고 테스트 스위트를 통과했습니다.
|
@coderabbitai review 현재 exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected='ac0129a2affcfea3a5c782035527502566016f7c'
echo '== Repository and requested-head identity =='
printf 'HEAD='
git rev-parse HEAD
printf 'expected=%s\n' "$expected"
git status --short
gh pr view 822 --json number,state,isDraft,headRefOid,baseRefName,headRefName,url
echo
echo '== Merge base and changed paths =='
base_ref="$(gh pr view 822 --json baseRefName --jq .baseRefName)"
base="$(git merge-base HEAD "origin/$base_ref")"
printf 'merge-base=%s\n' "$base"
git diff --name-status "$base...HEAD"
echo
echo '== Dependency declarations, lock metadata, tests, and documentation diffs =='
git diff --unified=30 "$base...HEAD" -- \
pyproject.toml uv.lock \
tests/test_project_metadata.py tests/test_pypdf_security_floor.py \
CHANGELOG.md docs/doctoring/dependency-security-baseline.md \
docs/product-technical-gap-baseline.md \
src/newsdom_api/main.py tests/test_parse_endpoint.py .jules/sentinel.md
echo
echo '== Current required dependency and advisory evidence =='
for file in \
pyproject.toml uv.lock \
tests/test_project_metadata.py tests/test_pypdf_security_floor.py \
CHANGELOG.md docs/doctoring/dependency-security-baseline.md \
docs/product-technical-gap-baseline.md
do
echo "--- $file"
rg -n -i -C 3 \
'pypdf|6\.15\.0|6\.16\.0|6\.16\.1|6\.18\.0|CVE-2026-84309|CVE-2026-84310|CVE-2026-84311|GHSA-jp53-mhqp-8xcg|GHSA-23w6-3w8w-8484|GHSA-763m-79hh-57f2|suppress|SSDF|Current authority|candidate|commit' \
"$file" || true
done
echo
echo '== Unrelated Form/Sentinel evidence at requested head =='
rg -n -i -C 3 'Form\s*\(\s*max_length\s*=|multipart.*OOM|parser.*OOM|form-admission' \
src/newsdom_api/main.py tests/test_parse_endpoint.py .jules/sentinel.md 2>/dev/null || true
echo
echo '== Diff against protected base for unrelated paths =='
git diff --unified=20 "$base...HEAD" -- \
src/newsdom_api/main.py tests/test_parse_endpoint.py .jules/sentinel.md
echo
echo '== Current PR checks =='
gh pr checks 822 --json name,state,workflow,link 2>&1 || true
echo
echo '== Unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='newsdom-api' -F number='822' -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
path
line
comments(first: 1) { nodes { author { login } body } }
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false) | {path, line, author: .comments.nodes[0].author.login, body: .comments.nodes[0].body}' 2>&1 || trueLength of output: 83653
유효한 finding이 1건 있습니다. [P1] Product baseline에 현재 exact candidate SHA를 기록하세요 — Line 9는
나머지 요청 범위는 확인했습니다.
현재 GREEN acceptance는 아직 성립하지 않습니다. Security Scan의 You are interacting with an AI system. |
|
Fresh owner split after exact-head Security run Separately, protected ancestry still has the verified unused #822 stays Draft: obtain the exact Trivy finding, repair it in its causal owner if needed, and keep the pypdf floor/lock contract unchanged unless authoritative advisory evidence requires otherwise. |
🚨 Severity: MEDIUM 💡 Vulnerability: /parse 엔드포인트의 language 및 mode Form 필드에 최대 길이(max_length) 제한이 설정되어 있지 않았습니다. 🎯 Impact: python-multipart가 폼 데이터를 메모리에 로드하므로, 악의적인 사용자가 매우 긴 문자열을 전송하여 메모리 고갈(OOM)을 통한 서비스 거부(DoS) 공격을 유발할 수 있습니다. 🔧 Fix: FastAPI의 Form 필드에 max_length=50 제약 조건을 명시적으로 추가했습니다. ✅ Verification: 비정상적으로 긴 폼 데이터를 전송했을 때 HTTP 422 응답이 반환되는지 확인하는 테스트 코드를 추가하고 테스트 스위트를 통과했습니다.
|
@coderabbitai review Current exact head is |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected='d9d48ec43918931e995fc1a8bacac3ddc1d568f6'
echo '== Requested head identity and PR metadata =='
printf 'HEAD='
git rev-parse HEAD
printf 'expected=%s\n' "$expected"
git status --short
gh pr view 822 --json number,state,isDraft,headRefOid,baseRefName,headRefName,url
echo
echo '== Protected-base diff paths =='
base_ref="$(gh pr view 822 --json baseRefName --jq .baseRefName)"
base="$(git merge-base HEAD "origin/$base_ref")"
printf 'merge-base=%s\n' "$base"
git diff --name-status "$base...HEAD"
echo
echo '== Dependency and evidence diff =='
git diff --unified=40 "$base...HEAD" -- \
pyproject.toml \
uv.lock \
tests/test_project_metadata.py \
tests/test_pypdf_security_floor.py \
CHANGELOG.md \
docs/doctoring/dependency-security-baseline.md \
docs/product-technical-gap-baseline.md
echo
echo '== Current dependency, advisory, and candidate-head evidence =='
for file in \
pyproject.toml \
uv.lock \
tests/test_project_metadata.py \
tests/test_pypdf_security_floor.py \
CHANGELOG.md \
docs/doctoring/dependency-security-baseline.md \
docs/product-technical-gap-baseline.md
do
echo "--- $file"
rg -n -i -C 3 \
'pypdf|6\.15\.0|6\.16\.0|6\.16\.1|6\.18\.0|CVE-2026-84309|CVE-2026-84310|CVE-2026-84311|GHSA-jp53-mhqp-8xcg|GHSA-23w6-3w8w-8484|GHSA-763m-79hh-57f2|suppress|current authority|candidate|exact head|commit|SSDF' \
"$file" || true
done
echo
echo '== Unrelated-path diff and current content checks =='
git diff --name-status "$base...HEAD" -- \
src/newsdom_api/main.py \
tests/test_parse_endpoint.py \
.jules/sentinel.md || true
rg -n -i -C 3 \
'Form\s*\(\s*max_length\s*=|multipart.*OOM|parser.*OOM|httpx2|httpcore2' \
src/newsdom_api/main.py \
tests/test_parse_endpoint.py \
.jules/sentinel.md \
pyproject.toml \
uv.lock 2>/dev/null || true
echo
echo '== Current checks =='
gh pr checks 822 --json name,state,workflow,link 2>&1 || true
echo
echo '== Unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='newsdom-api' -F number='822' -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
path
line
comments(first: 1) {
nodes { author { login } body }
}
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false) | {path, line, author: .comments.nodes[0].author.login, body: .comments.nodes[0].body}' 2>&1 || trueLength of output: 96892
[P1] 현재 pypdf candidate SHA를 명시하세요 — Line 9는 이 식별자가 없으면 이전 candidate의 검사 결과가 현재 generation의 증거로 연결될 수 있습니다. 나머지 요청 범위는 확인했습니다.
현재 GREEN acceptance는 아직 성립하지 않습니다. 이 exact head에서 You are interacting with an AI system. |
|
@coderabbitai review Protected |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected='c6153f707fd770a4e0191763d7b7681d47034d28'
base_expected='539528f9667524f6b65de0ee7b8b21fbdd97c380'
echo '== exact-head identity =='
printf 'HEAD='; git rev-parse HEAD
printf 'expected=%s\n' "$expected"
printf 'develop expected=%s\n' "$base_expected"
git status --short
gh pr view 822 --json number,state,isDraft,headRefOid,baseRefName,headRefName,url
echo
echo '== ancestry and effective comparison =='
git merge-base --is-ancestor "$base_expected" HEAD && echo 'base_is_ancestor=true' || echo 'base_is_ancestor=false'
git rev-list --left-right --count "$base_expected...HEAD"
git diff --name-status "$base_expected...HEAD"
echo
echo '== changed dependency, tests, and evidence =='
git diff --unified=50 "$base_expected...HEAD" -- \
pyproject.toml \
uv.lock \
tests/test_project_metadata.py \
tests/test_pypdf_security_floor.py \
CHANGELOG.md \
docs/doctoring/dependency-security-baseline.md \
docs/product-technical-gap-baseline.md
echo
echo '== exact evidence lines =='
for file in \
pyproject.toml \
uv.lock \
tests/test_project_metadata.py \
tests/test_pypdf_security_floor.py \
CHANGELOG.md \
docs/doctoring/dependency-security-baseline.md \
docs/product-technical-gap-baseline.md
do
echo "--- $file"
rg -n -i -C 3 \
'pypdf|6\.15\.0|6\.16\.0|6\.16\.1|6\.18\.0|CVE-2026-84309|CVE-2026-84310|CVE-2026-84311|GHSA-jp53-mhqp-8xcg|GHSA-23w6-3w8w-8484|GHSA-763m-79hh-57f2|suppress|current authority|candidate|exact head|commit|SSDF' \
"$file" || true
done
echo
echo '== unrelated paths absent from comparison =='
git diff --name-status "$base_expected...HEAD" -- \
src/newsdom_api/main.py \
tests/test_parse_endpoint.py \
.jules/sentinel.md || true
git diff --name-only "$base_expected...HEAD" | grep -E '(^|/)(main\.py|test_parse_endpoint\.py|sentinel\.md)$|httpx2|httpcore2' || true
echo
echo '== current check states =='
gh pr checks 822 --json name,state,workflow,link 2>&1 || true
echo
echo '== unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='newsdom-api' -F number='822' -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
path
line
comments(first: 1) {
nodes { author { login } body }
}
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false) | {path, line, author: .comments.nodes[0].author.login, body: .comments.nodes[0].body}' 2>&1 || trueLength of output: 101292
[P1] Product baseline에 현재 pypdf candidate SHA를 명시하세요 — Line 9는 그 외 요청 범위는 확인했습니다.
현재 GREEN acceptance는 성립하지 않습니다. You are interacting with an AI system. |
seonghobae
changed the title
|
@coderabbitai review Please review exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected_head='21c8d4271106d7ed568a8183c7a5e82de7fbe56a'
expected_base='539528f9667524f6b65de0ee7b8b21fbdd97c380'
echo '== Exact commit identity =='
printf 'HEAD='; git rev-parse HEAD
printf 'expected_head=%s\n' "$expected_head"
printf 'expected_base=%s\n' "$expected_base"
gh pr view 822 --json number,state,isDraft,headRefOid,baseRefName,headRefName,url
echo
echo '== Ancestry and effective diff =='
git merge-base --is-ancestor "$expected_base" HEAD && echo 'base_is_ancestor=true' || echo 'base_is_ancestor=false'
git rev-list --left-right --count "$expected_base...HEAD"
git diff --name-status "$expected_base...HEAD"
echo
echo '== Targeted diff =='
git diff --unified=50 "$expected_base...HEAD" -- \
pyproject.toml \
uv.lock \
tests/test_project_metadata.py \
tests/test_pypdf_security_floor.py \
CHANGELOG.md \
docs/doctoring/dependency-security-baseline.md \
docs/product-technical-gap-baseline.md \
.trivyignore.yaml
echo
echo '== Dependency, advisory, and current-candidate evidence =='
for file in \
pyproject.toml \
uv.lock \
tests/test_project_metadata.py \
tests/test_pypdf_security_floor.py \
CHANGELOG.md \
docs/doctoring/dependency-security-baseline.md \
docs/product-technical-gap-baseline.md \
.trivyignore.yaml
do
if [ -f "$file" ]; then
echo "--- $file"
rg -n -i -C 3 \
'pypdf|httpx2|httpcore2|6\.15\.0|6\.16\.0|6\.16\.1|6\.18\.0|2\.12\.0|CVE-2026-84309|CVE-2026-84310|CVE-2026-84311|GHSA-jp53-mhqp-8xcg|GHSA-23w6-3w8w-8484|GHSA-763m-79hh-57f2|suppress|candidate|exact head|current authority|trivy|SSDF' \
"$file" || true
fi
done
echo
echo '== Check dependency declarations and lock package metadata =='
rg -n -C 4 'pypdf>=6\.16\.1,<7\.0|httpx2|httpcore2' pyproject.toml uv.lock || true
echo
echo '== Verify no unrelated form/auth/Sentinel changes =='
git diff --name-status "$expected_base...HEAD" -- \
src/newsdom_api/main.py \
tests/test_parse_endpoint.py \
.jules/sentinel.md || true
git diff --name-only "$expected_base...HEAD" | \
grep -E '(^|/)(main\.py|test_parse_endpoint\.py|sentinel\.md)$|form|auth' || true
rg -n -i -C 2 'Form\s*\(\s*max_length\s*=|multipart.*OOM|parser.*OOM' \
src/newsdom_api/main.py tests/test_parse_endpoint.py .jules/sentinel.md 2>/dev/null || true
echo
echo '== Current PR checks =='
gh pr checks 822 --json name,state,workflow,link 2>&1 || true
echo
echo '== Unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='newsdom-api' -F number='822' -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
path
line
comments(first: 1) {
nodes { author { login } body }
}
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false) | {path, line, author: .comments.nodes[0].author.login, body: .comments.nodes[0].body}' 2>&1 || trueLength of output: 134664 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== HTTPX2 security-floor test structure =='
ast-grep outline tests/test_httpx2_security_floor.py --items all
echo
nl -ba tests/test_httpx2_security_floor.py | sed -n '1,260p'
echo
echo '== HTTPX2 lock metadata and direct-dependency consistency =='
rg -n -C 5 \
'name = "(httpx2|httpcore2)"|specifier = ">=2\.12\.0"|version = "2\.12\.0"|httpx2>=2\.12\.0|httpcore2>=2\.12\.0|CVE-2026-8437[8-9]|CVE-2026-8438[0-2]|GHSA-(f2fp-rgf2-35cp|h4x7-gw46-3wm6|pf96-p4fj-6566|7mj9-2mp8-4m2p|8xx6-hgc6-gc2m)' \
pyproject.toml uv.lock tests/test_httpx2_security_floor.py CHANGELOG.md docs/doctoring/dependency-security-baseline.md docs/product-technical-gap-baseline.md .trivyignore.yaml || true
echo
echo '== Current candidate references and prior product-baseline values =='
git log --format='%H %s' --all -- docs/product-technical-gap-baseline.md | head -20
git show "$expected_head:docs/product-technical-gap-baseline.md" | nl -ba | sed -n '1,65p'
echo
echo '== Current diff for HTTPX2 regression test =='
git diff --unified=60 539528f9667524f6b65de0ee7b8b21fbdd97c380...HEAD -- tests/test_httpx2_security_floor.pyLength of output: 24752
유효한 finding은 2건입니다.
확인한 범위는 다음과 같습니다.
GREEN acceptance는 아직 성립하지 않습니다. CodeQL compatibility, container image, fuzz, Strix, Noema, 및 CodeQL 일부 lane이 아직 진행 중입니다. You are interacting with an AI system. |
🚨 Severity: MEDIUM 💡 Vulnerability: /parse 엔드포인트의 language 및 mode Form 필드에 최대 길이(max_length) 제한이 설정되어 있지 않았습니다. 🎯 Impact: python-multipart가 폼 데이터를 메모리에 로드하므로, 악의적인 사용자가 매우 긴 문자열을 전송하여 메모리 고갈(OOM)을 통한 서비스 거부(DoS) 공격을 유발할 수 있습니다. 🔧 Fix: FastAPI의 Form 필드에 max_length=50 제약 조건을 명시적으로 추가했습니다. ✅ Verification: 비정상적으로 긴 폼 데이터를 전송했을 때 HTTP 422 응답이 반환되는지 확인하는 테스트 코드를 추가하고 테스트 스위트를 통과했습니다.
1 participant
문제와 current dependency authority
이 lane은 repository-wide dependency-security foundation입니다. Protected
develop은539528f9667524f6b65de0ee7b8b21fbdd97c380, current exact head는 **ce66ad092c14f6002e67c7b30ea5742a4968b5c1**이며 Draft/open/mergeable입니다. Fresh compare는 behind 0, effective files 8개입니다.현재 선언/lock contract:
pypdf>=6.16.1,<7.0, resolved6.18.0;httpx2>=2.12.0, resolved2.12.0;httpcore2>=2.12.0, resolved2.12.0;httpx>=0.28,<1.0은 기존 dev consumer와 별도이며 이 lane이 임의 제거하지 않습니다.Owner paths는
pyproject.toml,uv.lock, focused dependency regressions,CHANGELOG.md, dependency-security doctoring,docs/product-technical-gap-baseline.md로 한정됩니다. Auth/parser/product source는 이 dependency owner에 섞지 않습니다.RED → repair lineage
Protected tree의 known-vulnerable lock을 causal RED로 사용했습니다. pypdf advisory floor에 더해 HTTPX2 family의 strongest current patched floor가 2.12.0이므로 direct dev floor와 resolver-generated lock을 그 경계로 올렸습니다. Historical form/auth/generated-doctrine churn은 ordinary descendants에서 제거했습니다.
Fresh exact-head source confirms direct floors above, and current lock resolves pypdf 6.18.0 / HTTPX2 2.12.0. Security Scan run
34666601147independently distinguishes dependency payload from central evidence availability:103479657369: SUCCESS;103479657440: SUCCESS;103479657384: SUCCESS;103479657430: FAILURE only atCheck dependency review support; the pinned review action is skipped because the authoritative GitHub dependency comparison is unavailable. This exact canary was delivered to central availability owner.github#810; no leaf shim or skip-as-success is allowed.Thus there is no current Trivy/OSV evidence requiring a pypdf 6.18.1 or another dependency bump on this head. Scanner-clean results are not promoted as substitutes for Dependency Review.
Remaining exact-head blockers
34666601138, SAST34666601121, container34666601149, scorecards34666601108, ClusterFuzzLite34666601125are terminal GREEN.34666601100, job103479623278, is terminal FAILURE, but fresh log RCA shows this is not a source-analysis finding. Python/Actions extraction and query execution completed; SARIF combine/fingerprinting reached publication, then GitHub returnedAPI rate limit exceeded for installationat2026-09-12T02:06:32Z(requestC040:201F70:A6D086:21BD9F2:6AA4B3A8). Earlier telemetry/cache API calls in the same job also hit the installation quota. Exact evidence and RED/GREEN acceptance were delivered to central owner.github#1929. The leaf must still remain non-passing until authoritative SARIF publication succeeds; no waiver or synthetic GREEN is implied.34666601172is terminal FAILURE; Python/actions compatibility receivers fail and the later same-run dispatch itself also fails. That is a distinct central control-plane path and remains owner work; this leaf does not no-op retrigger, synthesize status, or copy central workflow source.Keep Draft. Normal merge requires one unchanged exact head with the dependency contracts above, focused/full tests and owned coverage/docstrings, authoritative Dependency Review, SAST/security/repository+required CodeQL, container/fuzz/scorecard, zero valid unresolved findings, and independent current-head review all terminally acceptable.
After normal protected merge, dependent auth/parser/export lanes adopt the new protected base by ordinary non-force descendants and reacquire exact-head evidence; mutable #822 head is never a consumer dependency.
No force push, destructive rebase, source-neutral/no-op retrigger, self-approval, bypass/gate weakening, scanner substitution, mutable sibling source copy, or predecessor evidence transfer.
Traceability