Commit History
5 days ago
-
security: extend the pillow 12.3.0 acceptances to 2026-12-18
avoigt1121 +1: Claude Opus 5.5The project lead decided 2026-11-03 ("Yes, extend", to "Extend the pillow acceptances to Fri 18 Dec?"): the 39 pillow 12.3.0 advisories accepted by id under fleet decision A (batches 1-8) now expire 2026-12-18, not 2026-11-20. Declined: forcing pillow 13 past gradio's pin, and freezing pushes (which would also block fixes like the 2026-11-01 joserfc bump). Only the expiry moves. security/accepted-vulns.txt changes the date on its 39 entries and nothing else (no id added or removed); tests/test_accepted_vulns.py raises its cap to 2026-12-18; security/ACCEPTED-FINDINGS.md gains one dated entry, earlier entries unchanged. The security addendum (docs/security/addendum-knowledge-specialist.md) states the expiry, and tests/test_host_table.py pins that statement: both now say 2026-12-18. Exposure re-check, 2026-11-03, on dev 9462c78 (44 commits since 2026-10-21): nil, unchanged. Inputs are identifiers only; no application code imports PIL, calls an image reader or reads a workbook (openpyxl…abc4da6
10 days ago
-
security: accept pillow 12.3.0 batch 8 (PYSEC-2026-4332)
avoigt1121 +1: Claude Opus 5.5One more pillow 12.3.0 advisory, found by the pre-push pip-audit on 2026-10-29 when it blocked the dev push of 39d4cd3 (Phase 3 smoke harness): - PYSEC-2026-4332 (CVE-2026-112403, GHSA-8g5g-8vmr-9782): a heap write in the JPEG decoder's draft()/thumbnail() path; fixed only in 13.0.0, which gradio does not allow (pillow<13). Not reachable here: no application code imports PIL, calls draft() or thumbnail(), or takes an image or file input. Accepted by id until 2026-11-20 as batch 8 under the project lead's 2026-10-28 decision (each Space repo at its next push after its own reachability check); 39 accepted, the addendum's count 38 -> 39. Security scan clean. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>943ab70
11 days ago
-
security: accept pillow 12.3.0 batch 7 (PYSEC-2026-4327)
avoigt1121 +1: Claude Opus 5.5One more pillow 12.3.0 advisory, found by the pre-push pip-audit on 2026-10-27 when it blocked the dev push of the UI OAuth fix (f8902cf): - PYSEC-2026-4327 (CVE-2026-112394): the P;2L/P;4L raw decoder reads up to three heap bytes past the buffer; fixed only in 13.0.0, which gradio does not allow (pillow<13). Not reachable here: no application code imports PIL or decodes an image a caller supplies. Accepted by id until 2026-11-20 as batch 7 (the project lead, 2026-10-27, in this session; already accepted that day in the other six Space repos); 38 accepted. Security scan clean; 267 passed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>2d3c377
13 days ago
-
security: accept pillow 12.3.0 batch 6 (CVE-2026-114501, CVE-2026-112398)
avoigt1121 +1: Claude Opus 5.5Two pillow 12.3.0 advisories published by 2026-10-26, fixed only in 13.0.0, which gradio does not allow (pillow<13): - CVE-2026-114501: Arrow export returns uninitialised heap memory when PILLOW_ALIGNMENT > 1. No PILLOW_ALIGNMENT here (code, README, HF Space variables) and no image is exported to Arrow. - CVE-2026-112398: FlashPix decoder heap overflow via Image.open on an OLE2 file; needs the optional olefile, which is not in the lock. Accepted by id until 2026-11-20 as batch 6 (the project lead, 2026-10-26, after a per-repo reachability check; ACCEPTED-FINDINGS.md has this repo's exposure statement); 37 accepted. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>1ed7f10
17 days ago
-
security: accept 1 more pillow 12.3.0 advisory until 2026-11-20 (batch 5)
avoigt1121 +1: Claude Opus 5.5GHSA-78g4-xqwv-q3g8 (high, no CVE id yet), published 2026-10-22 17:01 UTC after batch 4 and fixed only in pillow 13.0.0 (gradio 6.30 still requires pillow<13): a heap-buffer-overflow write in the libopenjp2 2.5.4 bundled in pillow wheels, reached by opening and loading a crafted JPEG 2000 file. No application code here opens JPEG 2000 or decodes a caller-supplied image. Accepted by id by the project lead (2026-10-22), same expiry and format as batches 1-4. Security files only; 35 pillow ids accepted; acceptance tests pass. The security-review addendum says 35, and tests/test_host_table.py now counts every accepted id (CVE, GHSA, PYSEC), not only CVE ids, so a GHSA-only advisory is counted. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>bd00037 -
security: accept 10 more pillow 12.3.0 advisories until 2026-11-20 (batch 4)
avoigt1121 +1: Claude Opus 5.5CVE-2026-96636 to -96644 and CVE-2026-96778, published 2026-10-22 after batch 3 and fixed only in pillow 13.0.0 (gradio 6.30 still requires pillow<13); they blocked the subtype dev push. None is reachable here: five need a crafted image from a caller decoded in a way no code does (multi-frame seek, SPIDER, BMP RLE, PNG EXIF parse), four need a Pillow call no application code makes (PDF append, JPEG save with ICC profile plus comment, bitmap-font text, TarIO), one is Windows-only. Accepted by id by the project lead (2026-10-22), same expiry and format as batches 1-3. Security files only; 34 pillow ids accepted; acceptance tests pass. The security-review addendum's pillow count goes 24 -> 34 (tests/test_host_table.py pins it to accepted-vulns.txt). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>8016795
18 days ago
-
security: accept 2 more pillow 12.3.0 advisories until 2026-11-20 (batch 3)
avoigt1121 +1: Claude Opus 5.5CVE-2026-112393 and CVE-2026-112396, both in TIFF encoding to an in-memory buffer, reached PyPI's feed after batch 2 and blocked s3's first dev-Space push. This Space encodes no image. The project lead accepted them the same day; the addendum now states 24 (its test reads the count from accepted-vulns.txt). Slice: phase1-knowledge-specialist-s3 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>cc8a03e -
security: accept 14 more pillow 12.3.0 advisories until 2026-11-20 (batch 2)
avoigt1121 +1: Claude Opus 5.5Published 2026-10-21 after batch 1 (D5-A), all fixed only in pillow 13.0.0. Same exposure: identifiers only, no image input. The addendum now states 22, and tests/test_host_table.py reads the count from security/accepted-vulns.txt instead of pinning it, so the next change cannot leave the addendum stale. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>e436d30 -
security: D5-A — accept the 8 pillow 12.3.0 CVEs here until 2026-11-20
avoigt1121 +1: Claude Opus 5.5The project lead decided D5-A (2026-10-20): a justified acceptance in this repo only. This Space takes identifiers only and opens no caller-supplied image; the fix needs a fleet-wide gradio move (gradio 6.28.0 requires pillow<13). security/accepted-vulns.txt feeds pip-audit --ignore-vuln; the scan fails on an expired entry, and tests/test_accepted_vulns.py fails once the lock moves pillow off 12.3.0, so the acceptance cannot outlive its reason. Scan green. Slice: phase1-knowledge-specialist/s2 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>17acd0c -
security: accept one gitleaks false positive by fingerprint; record the open pillow CVEs as D5
avoigt1121 +1: Claude Opus 5.5The s1 security record quoted the docstring phrase it called a false positive, so it tripped the same rule; reworded, and the never-pushed commit is ignored by its exact fingerprint. pillow 12.3.0 (via gradio 6.28.0, pillow<13) has 8 new CVEs fixed only in 13.0.0, fleet-wide: not accepted, raised as plan D5. Slice: phase1-knowledge-specialist/s2 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>e119adb
19 days ago
-
docs(security): record the first ADR-0014 scan run
avoigt1121 +1: Claude Opus 5.5pip-audit clean on the 119-package lock (gradio 6.28.0 + ToolUniverse 1.5.6), bandit and gitleaks clean; the one gitleaks false positive was fixed at the source, not allowlisted. Slice: phase1-knowledge-specialist/s1 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>97e7d80 -
feat: governed ToolUniverse core for the knowledge specialist (s1)
avoigt1121 +1: Claude Opus 5.5The repo from the pdac-spatial-agent template, plus the core every endpoint will sit on (ADR-0001, accepted 2026-10-20): - config/tools_allowlist.yaml: the memo's 28 tools by exact 1.5.6 name; the 12 the five endpoints use are the only ones loaded. - config/sources.yaml: 8 sources with hosts, licences checked 2026-10-20 (Reactome is CC0, not CC BY 4.0; DGIdb unconfirmed, so no DGIdb endpoint), TTLs, rate limits, timeouts, coverage notes. - src/tu_client.py, the only importer of tooluniverse: loads with keep_default_tools=False and load_workspace=False, refuses startup on any model-provider key, a version other than 1.5.6, an extra or forbidden tool, or ToolUniverse's own cache being on. load_workspace=False matters: with any workspace present, 1.5.6 seeds a profile that loads all 2,691 tools and reads workspace and ~/.tooluniverse .env files (found by these tests). - provenance (10 fields per row), pinned output schemas (drift = no rows), SQLite cache that keeps retr…377417d