chore(deps): bump uv to >=0.11.15 and ignore unfixable chromadb CVE#5992
Merged
Conversation
uv 0.11.7 -> 0.11.17 patches GHSA-4gg8-gxpx-9rph. chromadb has no patched release for GHSA-f4j7-r4q5-qw2c (server-only pre-auth RCE, not reachable in our embedded use); ignore until upstream ships a fix.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdds GHSA-f4j7-r4q5-qw2c to pip-audit ignore lists (pre-commit and CI) and updates ChangesSecurity vulnerability mitigations
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.pre-commit-config.yaml (1)
29-31: ⚡ Quick winDocument why each vulnerability is ignored.
Add inline comments explaining the rationale for ignoring each vulnerability, especially for security audit purposes. Based on the PR description, GHSA-f4j7-r4q5-qw2c affects chromadb's HTTP server (not reachable in embedded usage) and has no patched version available.
📝 Proposed documentation addition
- repo: local hooks: - id: pip-audit name: pip-audit + # CVE-2026-3219: [add rationale] + # GHSA-f4j7-r4q5-qw2c: chromadb pre-auth RCE in HTTP server; not reachable in embedded usage; no patch available (tracked at chroma-core/chroma#6717) entry: bash -c 'source .venv/bin/activate && uv run pip-audit --skip-editable --ignore-vuln CVE-2026-3219 --ignore-vuln GHSA-f4j7-r4q5-qw2c' --🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.pre-commit-config.yaml around lines 29 - 31, Add inline comments to the pip-audit entry in .pre-commit-config.yaml explaining why each ignored vulnerability is excluded: annotate CVE-2026-3219 with the specific rationale from the PR and annotate GHSA-f4j7-r4q5-qw2c noting it targets chromadb's HTTP server which is not reachable in our embedded usage and that no patched version exists; use YAML comments (#) immediately after the --ignore-vuln tokens (or on the same line) and reference the vulnerability IDs (CVE-2026-3219, GHSA-f4j7-r4q5-qw2c) and the PR justification so future reviewers can understand the decision.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.pre-commit-config.yaml:
- Line 31: The pip-audit ignore flags in the pre-commit entry (the bash command
string in .pre-commit-config.yaml that runs "uv run pip-audit --skip-editable
--ignore-vuln CVE-2026-3219 --ignore-vuln GHSA-f4j7-r4q5-qw2c") are out of sync
with the CI workflow (vulnerability-scan.yml) which ignores a long PYSEC-* list
but not CVE-2026-3219; update both to use the same ignore set by either
extracting ignores into a shared file/variable or by adding the PYSEC-*
identifiers from vulnerability-scan.yml into the pre-commit pip-audit command
and adding CVE-2026-3219 to the CI workflow’s pip-audit step, and document the
rationale for each ignored ID so local pre-push and CI behave identically.
---
Nitpick comments:
In @.pre-commit-config.yaml:
- Around line 29-31: Add inline comments to the pip-audit entry in
.pre-commit-config.yaml explaining why each ignored vulnerability is excluded:
annotate CVE-2026-3219 with the specific rationale from the PR and annotate
GHSA-f4j7-r4q5-qw2c noting it targets chromadb's HTTP server which is not
reachable in our embedded usage and that no patched version exists; use YAML
comments (#) immediately after the --ignore-vuln tokens (or on the same line)
and reference the vulnerability IDs (CVE-2026-3219, GHSA-f4j7-r4q5-qw2c) and the
PR justification so future reviewers can understand the decision.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 505f800e-2da2-4d01-a419-cfb9c063c23c
⛔ Files ignored due to path filters (1)
uv.lockis excluded by!**/*.lock
📒 Files selected for processing (2)
.pre-commit-config.yamlpyproject.toml
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/vulnerability-scan.yml:
- Line 85: Update the GHSA comment for GHSA-f4j7-r4q5-qw2c / CVE-2026-45829 in
the vulnerability-scan workflow to align with the official advisory: remove or
reword the claim "unreachable in embedded use" unless you add a brief
repo-specific justification explaining why our usage is not vulnerable, and
explicitly note the advisory's vulnerable range (>=1.0.0, <=1.5.9) and the
absence of a firstPatchedVersion (i.e., no fix available); ensure the comment
clearly states either the factual advisory details or a short,
repository-specific mitigation rationale referencing GHSA-f4j7-r4q5-qw2c and
CVE-2026-45829.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 8de44bec-6535-43df-ac5d-1ea891866671
📒 Files selected for processing (1)
.github/workflows/vulnerability-scan.yml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps
uvpin to>=0.11.15for GHSA-4gg8-gxpx-9rph (lockfile: 0.11.7 -> 0.11.17).Adds GHSA-f4j7-r4q5-qw2c (chromadb pre-auth RCE in the HTTP server) to the
pip-auditignore list. No patched chromadb release exists (advisory covers 1.0.0..1.5.9) and the vulnerable route is unreachable in crewai's embedded use. Upstream fix tracked at chroma-core/chroma#6717.Note
Low Risk
Dependency pin and lockfile updates plus documented pip-audit suppressions; chromadb ignore is justified by embedded-only client usage, not running the vulnerable HTTP API.
Overview
Raises the workspace
uvfloor to>=0.11.15(lock resolves to 0.11.17) to address GHSA-4gg8-gxpx-9rph, with matching comment updates inpyproject.toml.Aligns
pip-auditbetween CI and pre-push: the pre-commit hook now uses the same long--ignore-vulnlist as.github/workflows/vulnerability-scan.yml, including newGHSA-f4j7-r4q5-qw2c(chromadb HTTP-server RCE, no fixed release). CI comments document that crewAI only useschromadb.PersistentClient, so the advisory route is considered out of scope.uv.lockrefreshes the resolveduvpackage and bumpsexclude-newer; the per-packagestarletteexclude-newer cap is removed.Reviewed by Cursor Bugbot for commit ec8b4a6. Bugbot is set up for automated code reviews on this repo. Configure here.
Summary by CodeRabbit