Commit History
5 days ago
-
security: extend the pillow 12.3.0 acceptances to 2026-12-18
avoigt1121 +1: Claude Opus 5.5The project lead decided 2026-11-03 ("Yes, extend", to "Extend the pillow acceptances to Fri 18 Dec?"): the 39 pillow 12.3.0 advisories accepted by id under fleet decision A (batches 1-8) now expire 2026-12-18, not 2026-11-20. Declined: forcing pillow 13 past gradio's pin, and freezing pushes (which would also block fixes like the 2026-11-01 joserfc bump). Only the expiry moves. security/accepted-vulns.txt changes the date on its 39 entries and nothing else (no id added or removed); tests/test_accepted_vulns.py raises its cap to 2026-12-18; security/ACCEPTED-FINDINGS.md gains one dated entry, earlier entries unchanged. The security addendum (docs/security/addendum-knowledge-specialist.md) states the expiry, and tests/test_host_table.py pins that statement: both now say 2026-12-18. Exposure re-check, 2026-11-03, on dev 9462c78 (44 commits since 2026-10-21): nil, unchanged. Inputs are identifiers only; no application code imports PIL, calls an image reader or reads a workbook (openpyxl…abc4da6
10 days ago
-
security: accept pillow 12.3.0 batch 8 (PYSEC-2026-4332)
avoigt1121 +1: Claude Opus 5.5One more pillow 12.3.0 advisory, found by the pre-push pip-audit on 2026-10-29 when it blocked the dev push of 39d4cd3 (Phase 3 smoke harness): - PYSEC-2026-4332 (CVE-2026-112403, GHSA-8g5g-8vmr-9782): a heap write in the JPEG decoder's draft()/thumbnail() path; fixed only in 13.0.0, which gradio does not allow (pillow<13). Not reachable here: no application code imports PIL, calls draft() or thumbnail(), or takes an image or file input. Accepted by id until 2026-11-20 as batch 8 under the project lead's 2026-10-28 decision (each Space repo at its next push after its own reachability check); 39 accepted, the addendum's count 38 -> 39. Security scan clean. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>943ab70 -
feat(smoke): the scheduled smoke Job, and the plan's decisions
avoigt1121 +1: Claude Opus 5.5scripts/smoke_job.py creates, lists, fetches and deletes the Phase 3 smoke Job as decided 2026-10-29 (D1-D4): an HF Scheduled Job on cpu-basic in the project lead's organisation namespace (her user namespace holds lit-agent's Monday job, whose recreate script aborts on a second scheduled Job), every 3 hours, ending itself after 7 days (SMOKE_END_EPOCH), with no secret: each run clones the dev Space at a pinned sha, runs smoke_live.py in-process and prints its counts-only record behind RECORD_MARKER (new --print-record), and fetch reads the records back from the Job logs into .smoke/hf-job.jsonl. tests/test_smoke_job.py pins the spec (no secret, cpu-basic, org namespace, one Job at a time, the end guard, the pinned sha) and the log parsing. The addendum gets one sentence on the scheduled runs (plan C8); the plan records D1-D4. Slice: phase3-review-hardening/s3 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>814e741
11 days ago
-
docs(sources): confirm UniProt, ClinicalTrials.gov and DGIdb licences
avoigt1121 +1: Claude Opus 5.5All three pages are script-rendered; read in a browser on 2026-10-27. - UniProt: uniprot.org/help/license applies CC BY 4.0. Stamped string unchanged. - ClinicalTrials.gov: the Terms and Conditions page names no open licence; it asks redistributors to attribute, keep current, show the processing date and state changes, and notes copyright outside the U.S. Stamped string unchanged; licence_checked says "Public" means free of charge. - DGIdb: no data licence of its own (code is MIT); each interaction keeps its source's licence, several non-commercial. licence becomes "Per source: ...", licence_url moves to /browse/sources (/about is a 404). The no-endpoint guard now covers "Per source" as well as "Unconfirmed". No DGIdb endpoint is added or proposed. Host table regenerated with scripts/render_host_table.py. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>8f6c965 -
security: accept pillow 12.3.0 batch 7 (PYSEC-2026-4327)
avoigt1121 +1: Claude Opus 5.5One more pillow 12.3.0 advisory, found by the pre-push pip-audit on 2026-10-27 when it blocked the dev push of the UI OAuth fix (f8902cf): - PYSEC-2026-4327 (CVE-2026-112394): the P;2L/P;4L raw decoder reads up to three heap bytes past the buffer; fixed only in 13.0.0, which gradio does not allow (pillow<13). Not reachable here: no application code imports PIL or decodes an image a caller supplies. Accepted by id until 2026-11-20 as batch 7 (the project lead, 2026-10-27, in this session; already accepted that day in the other six Space repos); 38 accepted. Security scan clean; 267 passed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>2d3c377
13 days ago
-
security: accept pillow 12.3.0 batch 6 (CVE-2026-114501, CVE-2026-112398)
avoigt1121 +1: Claude Opus 5.5Two pillow 12.3.0 advisories published by 2026-10-26, fixed only in 13.0.0, which gradio does not allow (pillow<13): - CVE-2026-114501: Arrow export returns uninitialised heap memory when PILLOW_ALIGNMENT > 1. No PILLOW_ALIGNMENT here (code, README, HF Space variables) and no image is exported to Arrow. - CVE-2026-112398: FlashPix decoder heap overflow via Image.open on an OLE2 file; needs the optional olefile, which is not in the lock. Accepted by id until 2026-11-20 as batch 6 (the project lead, 2026-10-26, after a per-repo reachability check; ACCEPTED-FINDINGS.md has this repo's exposure statement); 37 accepted. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>1ed7f10
17 days ago
-
security: accept 1 more pillow 12.3.0 advisory until 2026-11-20 (batch 5)
avoigt1121 +1: Claude Opus 5.5GHSA-78g4-xqwv-q3g8 (high, no CVE id yet), published 2026-10-22 17:01 UTC after batch 4 and fixed only in pillow 13.0.0 (gradio 6.30 still requires pillow<13): a heap-buffer-overflow write in the libopenjp2 2.5.4 bundled in pillow wheels, reached by opening and loading a crafted JPEG 2000 file. No application code here opens JPEG 2000 or decodes a caller-supplied image. Accepted by id by the project lead (2026-10-22), same expiry and format as batches 1-4. Security files only; 35 pillow ids accepted; acceptance tests pass. The security-review addendum says 35, and tests/test_host_table.py now counts every accepted id (CVE, GHSA, PYSEC), not only CVE ids, so a GHSA-only advisory is counted. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>bd00037 -
security: accept 10 more pillow 12.3.0 advisories until 2026-11-20 (batch 4)
avoigt1121 +1: Claude Opus 5.5CVE-2026-96636 to -96644 and CVE-2026-96778, published 2026-10-22 after batch 3 and fixed only in pillow 13.0.0 (gradio 6.30 still requires pillow<13); they blocked the subtype dev push. None is reachable here: five need a crafted image from a caller decoded in a way no code does (multi-frame seek, SPIDER, BMP RLE, PNG EXIF parse), four need a Pillow call no application code makes (PDF append, JPEG save with ICC profile plus comment, bitmap-font text, TarIO), one is Windows-only. Accepted by id by the project lead (2026-10-22), same expiry and format as batches 1-3. Security files only; 34 pillow ids accepted; acceptance tests pass. The security-review addendum's pillow count goes 24 -> 34 (tests/test_host_table.py pins it to accepted-vulns.txt). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>8016795 -
docs: name no institution in the public repo (the client's Tech Transfer rule)
avoigt1121 +1: Claude Opus 5.5Both Spaces are public. The client's sponsoring lab ruled 2026-10-21 that its technology-transfer office looks before anything public carries the institution's or the centre's name, and the contract needs written consent for either. Ten mentions in docs, docstrings and comments now say "the client" or "this agent's endpoints"; the title, card, README and UI never named either. tests/test_no_institution_name.py fails if a tracked file names them again. The paste-ready addendum in the business folder is unchanged. Comments and docs only: no behaviour change. 246 passed; host table current. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>081f1c7
18 days ago
-
security: accept 2 more pillow 12.3.0 advisories until 2026-11-20 (batch 3)
avoigt1121 +1: Claude Opus 5.5CVE-2026-112393 and CVE-2026-112396, both in TIFF encoding to an in-memory buffer, reached PyPI's feed after batch 2 and blocked s3's first dev-Space push. This Space encodes no image. The project lead accepted them the same day; the addendum now states 24 (its test reads the count from accepted-vulns.txt). Slice: phase1-knowledge-specialist-s3 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>cc8a03e -
security: accept 14 more pillow 12.3.0 advisories until 2026-11-20 (batch 2)
avoigt1121 +1: Claude Opus 5.5Published 2026-10-21 after batch 1 (D5-A), all fixed only in pillow 13.0.0. Same exposure: identifiers only, no image input. The addendum now states 22, and tests/test_host_table.py reads the count from security/accepted-vulns.txt instead of pinning it, so the next change cannot leave the addendum stale. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>e436d30 -
docs(security): the knowledge specialist's security-review addendum (s4)
avoigt1121 +1: Claude Opus 5.5docs/security/addendum-knowledge-specialist.md, in the review's own language: the eighth component, the hosts it calls (a table generated from config/sources.yaml by scripts/render_host_table.py), identifiers-only egress, the honest no-egress-filter sentence, and the controls. tests/test_host_table.py fails if the table is stale or any number the addendum states (tools, rates, timeouts, caps, TTLs, the pinned version, the accepted findings) stops matching the code, or if a person is named. A paste-ready version for the OHSU form lives beside the review in the business folder; filing it is the project lead's. Slice: phase1-knowledge-specialist/s4 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>a8943e8