fix(security): suppress uv-missing-dependency-cooldown on agent/pyproject.toml (#532)#539
Open
mandeep408 wants to merge 4 commits into
Open
fix(security): suppress uv-missing-dependency-cooldown on agent/pyproject.toml (#532)#539mandeep408 wants to merge 4 commits into
mandeep408 wants to merge 4 commits into
Conversation
…ject.toml (#532) semgrep's uv-missing-dependency-cooldown rule wants a global exclude-newer cooldown under [tool.uv]. Setting one is structurally incompatible with this repo: deps are exact-pinned (==) and several pins (fastapi, bedrock-agentcore, boto3) are to versions published within any reasonable cooldown window, so a global exclude-newer makes `uv lock`/`uv sync` unsatisfiable and re-breaks on every fresh pin bump. The rule's threat model (surprise malicious/unstable version) is already covered by exact pins + committed uv.lock + reviewed upgrade-main PRs + uv sync --frozen in the image. Suppress with a justified nosemgrep on the line preceding [tool.uv] rather than adding a redundant, workflow-breaking cooldown. Approach approved by maintainer (Option B) in #532. Verified: `mise run security:sast` -> 0 findings; `uv sync --all-groups` and `uv lock --check` both resolve. Fixes #532 Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Suppress the semgrep
uv-missing-dependency-cooldownfinding onagent/pyproject.tomlvia a justifiednosemgrep, rather than adding a globalexclude-newercooldown.Fixes #532.
Why not the originally-proposed
exclude-newer = "7 days"Verified that a global relative cooldown is structurally incompatible with this repo's exact
==pins: several pins (fastapi, bedrock-agentcore, boto3) are to versions published inside any reasonable window, soexclude-newermakesuv lock/uv syncunsatisfiable and re-breaks on every fresh pin bump. Full analysis and the maintainer's approval reversal are in the issue thread — decision was Option B (justifiednosemgrep).The rule's threat model (surprise malicious/unstable version) is already covered by exact pins + committed
uv.lock+ reviewedupgrade-mainPRs +uv sync --frozenin the image, so a global cooldown would be redundant and would fight the pinning workflow.Change
One justified
nosemgrepon the line preceding[tool.uv]inagent/pyproject.toml(+8 lines, comment + directive). Scope:agent/pyproject.tomlonly.Verification (local, on this branch rebased atop merged #537)
mise run security:sast→ 0 findings (suppressed).uv sync --all-groupsanduv lock --check→ both resolve (no build break).mise run security:secrets(gitleaks) →no leaks found(green now that fix(security): gitleaks fails on main — #530 SHA-keyed baseline broke after history rewrite #537 is inmain).mise //agent:quality→ lint + type + 1125 tests pass.Notes / follow-ups (separate, per maintainer)
semgrep = "latest"+--config auto).uv sync --frozenin the CI install task — ADR-009 / 2P track.security:sast:maskingfails onmain(pre-existing, incli/src/commands/jira.ts,linear.ts,cdk/src/handlers/shared/jira-feedback.ts) — unrelated to this PR; worth its own issue.Co-Authored-By: Claude noreply@anthropic.com