From fac50926b7f70b6e4726090a2cf27b19cbc43c7e Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 26 Aug 2026 19:32:54 +0000 Subject: [PATCH 1/4] Upgrade pip/setuptools before pip-audit to cut CI noise The Dependency Audit job installs its environment via conda, which ships a stale bootstrap pip/setuptools that pip-audit dutifully reports CVEs for -- unrelated to any of the project's actual dependencies. This has been failing PRs (e.g. #16) on toolchain findings rather than real application vulnerabilities. Upgrading pip/setuptools right before the audit keeps the check meaningful. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_015pw5723CL7SaUDUhhXfVSf --- .github/workflows/security.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 6a60fb4..67c8a5b 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -31,6 +31,13 @@ jobs: miniforge-version: latest conda-solver: libmamba + - name: Upgrade pip and setuptools + # conda-created environments often ship an old bootstrap pip/setuptools + # that pip-audit flags regardless of any application dependency -- + # keep those current so the audit reflects real findings, not noise + # from the toolchain itself. + run: pip install --upgrade pip setuptools + - name: Audit dependencies for known CVEs run: pip-audit --format=markdown --output=pip-audit-report.md || true From 7fc50440134bd12eb4e96e26d88ac7f643f0ef46 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 26 Aug 2026 19:45:00 +0000 Subject: [PATCH 2/4] Pin click>=8.3.3 to fix a real pip-audit finding (PYSEC-2026-2132) With the pip/setuptools bootstrap noise cleared, pip-audit now surfaces a genuine vulnerability: click 8.2.1 (pulled in transitively by mkdocs, dash, and black -- none of the project's own files depend on it directly) is affected by PYSEC-2026-2132, fixed in 8.3.3. Pin it directly in both environment.yml and requirements.txt so the resolver picks a patched version regardless of what its dependents' own floors allow. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_015pw5723CL7SaUDUhhXfVSf --- environment.yml | 5 +++++ requirements.txt | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/environment.yml b/environment.yml index a0ae230..cab6891 100644 --- a/environment.yml +++ b/environment.yml @@ -28,6 +28,11 @@ dependencies: # Security scanning - pip-audit>=2.6.0 + # Transitive dependency of mkdocs/dash/black; pinned directly to force a + # patched version regardless of what its own dependents' floors allow. + # PYSEC-2026-2132 (click < 8.3.3) + - click>=8.3.3 + # Documentation (conda-forge) - mkdocs>=1.5.0 - mkdocs-material>=9.5.0 diff --git a/requirements.txt b/requirements.txt index ea38571..6a4be50 100644 --- a/requirements.txt +++ b/requirements.txt @@ -28,3 +28,8 @@ mkdocs>=1.5.0 mkdocs-material>=9.5.0 mkdocstrings[python]>=0.24.0 mkdocs-jupyter>=0.24.0 + +# Transitive dependency of mkdocs/dash/black; pinned directly to force a +# patched version regardless of what its own dependents' floors allow. +# PYSEC-2026-2132 (click < 8.3.3) +click>=8.3.3 From b65e335d8ff3a635c9aab1c356badbe5cdc289c0 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 26 Aug 2026 19:47:42 +0000 Subject: [PATCH 3/4] Install click via pip, not conda: conda-forge's mkdocs caps it <8.3 The click>=8.3.3 pin (for PYSEC-2026-2132) broke conda's environment solve entirely, failing every job in CI (lint, type-check, tests, pip-audit alike, since they all build from environment.yml): mkdocs>=1.5.0 requires click>=7.0,<8.3.0a0 -- conda-forge's mkdocs build hasn't been rebuilt against a newer click yet, making click>=8.3.3 unsatisfiable in the conda solve. PyPI's mkdocs has no such cap (verified: mkdocs + click>=8.3.3 install together cleanly via pip). Moved the click pin into environment.yml's existing `pip:` sub-section instead of conda's dependency list -- the same pattern already used here for kaleido/mkdocstrings/mkdocs-jupyter. pip installs after conda's solve completes, so it upgrades whatever click conda pulled in as mkdocs's transitive dependency, without conda ever needing to solve for the newer version itself. requirements.txt (pure pip) is unaffected -- click>=8.3.3 already resolves fine there. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_015pw5723CL7SaUDUhhXfVSf --- environment.yml | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/environment.yml b/environment.yml index cab6891..4125d9f 100644 --- a/environment.yml +++ b/environment.yml @@ -28,11 +28,6 @@ dependencies: # Security scanning - pip-audit>=2.6.0 - # Transitive dependency of mkdocs/dash/black; pinned directly to force a - # patched version regardless of what its own dependents' floors allow. - # PYSEC-2026-2132 (click < 8.3.3) - - click>=8.3.3 - # Documentation (conda-forge) - mkdocs>=1.5.0 - mkdocs-material>=9.5.0 @@ -43,3 +38,11 @@ dependencies: - kaleido>=0.2.1 - mkdocstrings[python]>=0.24.0 - mkdocs-jupyter>=0.24.0 + # Transitive dependency of mkdocs/dash/black; pinned directly to force + # a patched version regardless of what its own dependents' floors + # allow. PYSEC-2026-2132 (click < 8.3.3). Installed via pip rather + # than as a conda package: conda-forge's mkdocs build still caps + # click at <8.3.0a0, which makes this unsatisfiable in the conda + # solve; PyPI's mkdocs has no such cap, and pip installs after conda + # so this upgrades whatever click conda pulled in as a transitive dep. + - click>=8.3.3 From af5670ac7df81190da7a7e128043cebad2f500dd Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 26 Aug 2026 19:51:23 +0000 Subject: [PATCH 4/4] Scope the click fix to the audit job; revert the shared-env pin click>=8.3.3 requires Python >=3.10, so pinning it in environment.yml (shared by every workflow, including test.yml's Python 3.9 matrix entry) broke that job outright: pip could find no matching click release for 3.9. requirements.txt's identical pin was harmless there (docs.yml, its only consumer, is Python-3.11-only) but created a confusing asymmetry with nothing actually depending on it. Reverted both files to their state on main and moved the entire click fix into the one place it's actually needed: security.yml's dependency-audit job, which always runs Python 3.11 regardless of the test matrix. Upgrades click via pip right after the pip/setuptools step, same rationale as that fix (conda-forge's mkdocs still caps click below the patched version; PyPI has no such cap). Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_015pw5723CL7SaUDUhhXfVSf --- .github/workflows/security.yml | 10 ++++++++++ environment.yml | 8 -------- requirements.txt | 5 ----- 3 files changed, 10 insertions(+), 13 deletions(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 67c8a5b..8ecf14d 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -38,6 +38,16 @@ jobs: # from the toolchain itself. run: pip install --upgrade pip setuptools + - name: Upgrade click (PYSEC-2026-2132) + # click is a transitive dependency of mkdocs/dash/black -- not + # declared anywhere in this project directly -- and conda-forge's + # mkdocs build still caps it below the patched version, so this + # job (always Python 3.11) upgrades it via pip after conda's solve. + # Scoped to this job only: click>=8.3.3 requires Python >=3.10, + # which would break environment.yml's Python 3.9 entry in the test + # matrix if pinned there instead. + run: pip install --upgrade "click>=8.3.3" + - name: Audit dependencies for known CVEs run: pip-audit --format=markdown --output=pip-audit-report.md || true diff --git a/environment.yml b/environment.yml index 4125d9f..a0ae230 100644 --- a/environment.yml +++ b/environment.yml @@ -38,11 +38,3 @@ dependencies: - kaleido>=0.2.1 - mkdocstrings[python]>=0.24.0 - mkdocs-jupyter>=0.24.0 - # Transitive dependency of mkdocs/dash/black; pinned directly to force - # a patched version regardless of what its own dependents' floors - # allow. PYSEC-2026-2132 (click < 8.3.3). Installed via pip rather - # than as a conda package: conda-forge's mkdocs build still caps - # click at <8.3.0a0, which makes this unsatisfiable in the conda - # solve; PyPI's mkdocs has no such cap, and pip installs after conda - # so this upgrades whatever click conda pulled in as a transitive dep. - - click>=8.3.3 diff --git a/requirements.txt b/requirements.txt index 6a4be50..ea38571 100644 --- a/requirements.txt +++ b/requirements.txt @@ -28,8 +28,3 @@ mkdocs>=1.5.0 mkdocs-material>=9.5.0 mkdocstrings[python]>=0.24.0 mkdocs-jupyter>=0.24.0 - -# Transitive dependency of mkdocs/dash/black; pinned directly to force a -# patched version regardless of what its own dependents' floors allow. -# PYSEC-2026-2132 (click < 8.3.3) -click>=8.3.3