chore(audit): Q3 2026 Splunk version-pinning audit

[RelativisticJet]

Summary

Q3 2026 quarterly Splunk version-pinning audit. Creates CLAUDE.md (tracking file for the audit checklist and log), appends a dated entry to docs/PIP_AUDIT_LOG.md, and removes the accidental CLAUDE.md gitignore exclusion.

Recommended next action: BUMP docker-compose.yml to splunk/splunk:9.4.12 — Splunk 9.3.x reaches End of Support on 2026-07-24 (6 days from today).

Type of change

• Documentation update
• Security fix (please also follow SECURITY.md)

Related issues

Test Plan

• Unit tests added / updated (tests/unit/)
• Integration tests added / updated (tests/integration/)
• E2E tests added / updated (tests/e2e/)
• Manual verification steps documented below

Pure-Python test run (952 tests):

python -m pytest tests/unit/ tests/test_wl_limits.py tests/test_wl_fim_common.py \
    tests/test_wl_expiration_cleanup.py -q
# Result: 952 passed, 1 warning (trivial invalid escape sequence in docstring)

Verification

• No new secrets / credentials / personal data added to source
• default/app.conf build bumped if user-visible behavior changed — N/A (docs-only)

---

Audit findings

Step 1 — Splunk 9.3.x support status

Pinned version	9.3.1
Current GA	10.4.1 (released 2026-06-30)
Latest 9.3.x patch	9.3.13
9.3.x EOS date	2026-07-24 — 6 days away

Action required: The pin is critically out of date. 9.3.1 is 12 minor patches behind 9.3.13, and the entire 9.3.x line reaches End of Support this week.

Step 2 — CVE scan against 9.3.x (as of 2026-07-18)

CVE	CVSS	Affects 9.3.1?	Fixed in
CVE-2026-20253	9.8 (CRITICAL)	No — 10.2 < 10.2.4 and 10.0 < 10.0.7 only	10.2.4 / 10.0.7
CVE-2026-22796	—	Yes — OpenSSL issue affects 9.3.1–9.3.10	9.3.11
Third-party package updates (SVD-2026-0505)	—	Likely yes — fixed in 9.3.12+	9.3.12

Even if we bump to 9.3.13 now, the 9.3.x line goes EOL in 6 days. Recommend bumping to 9.4.12 instead.

Step 3 — pip-audit on requirements-dev.txt (2026-07-18)

OSV API (api.osv.dev) unreachable from agent environment (proxy policy denial). Web-search fallback used. Full findings appended to docs/PIP_AUDIT_LOG.md.

Package	Pinned	Finding
pytest	9.0.3	clean
pytest-cov	5.0.0	clean
freezegun	1.5.1	clean
hypothesis	6.90.0	clean
pytest-timeout	2.1.0	clean
playwright	1.60.0	clean (CVE-2025-59288 fixed in ≥1.55.1)
radon	6.0.1	clean

No pin changes needed.

Step 4 — Splunk 10.x compatibility risk table

Splunk 10.0 GA: 2025-07-28. Current: 10.4.1 (2026-06-30).

Risk area	10.x changed?	Breaks wl_manager?	Evidence
REST handler base class	Yes (partial)	manual-test-needed	10.2+ moves Splunk Web custom REST endpoints to Python 3.13; new disable_custom_rest_endpoints setting in 10.4. Base class still exists but env has changed.
mvc.Components two-instance quirk	Unknown	manual-test-needed	No 10.x release notes mention found.
INDEXED_EXTRACTIONS + KV_MODE interaction	No	No	Behavior is unchanged and documented the same in 10.4 props.conf reference.
Scheduled-search impersonation	Unknown	manual-test-needed	No 10.x release notes mention found.
simpleRequest 404 behaviour	Unknown	manual-test-needed	No 10.x release notes mention found.
MAX_MULTIVAL_COUNT limit	Unknown	manual-test-needed	No 10.x release notes mention found.
panel-depends reactivity	Unknown	manual-test-needed	No 10.x release notes mention found.

Additional 10.x concerns:

• Python 3.13 becomes the runtime for Splunk Web custom REST endpoints in 10.2+ — all bin/ handlers need a Python 3.13 compat check
• Non-root execution enforced in 10.4 — may affect file-permission assumptions in lookups/
• Legacy jQuery removed in 10.0 — dashboard JS audit required

Step 5 — Pure-Python test suite

952 passed, 1 warning in 46.71s

All unit tests and module-level tests pass. The 1 warning is a non-functional invalid escape sequence \`` in a docstring at tests/unit/test_validation.py:155`.

Note: tests/test_wl_hmac_key.py does not exist as a standalone file; HMAC key tests live at tests/unit/test_hmac_key.py. The stored audit-task command references a non-existent file — run command updated in CLAUDE.md.

---

Recommended next actions

1. Immediate (this week): Bump docker-compose.yml line 19 from splunk/splunk:9.3.1 to splunk/splunk:9.4.12. This exits the EOL 9.3.x line with minimal compatibility risk (9.3→9.4 is a minor-version bump).

2. Short-term (Q3 2026): Open a compat-work tracking ticket for 10.x migration. Run the 7 risk areas in CLAUDE.md against a 10.4.x container. Pay particular attention to Python 3.13 compatibility of bin/ handlers.

3. Maintenance: Allowlist api.osv.dev in the agent proxy config so future automated OSV audits can use direct API calls rather than web-search fallback.

Audit-trail impact

• This PR does NOT add or modify any handler action (no audit impact)

Documentation

• No docs change required (this PR IS the documentation update)

Reviewer notes

This is a research-and-report PR — no production code changes. The only file-system changes are:

• .gitignore: removes accidental CLAUDE.md exclusion
• CLAUDE.md: new file, developer/agent guidance only
• docs/PIP_AUDIT_LOG.md: appended audit entry

The pin bump itself (docker-compose.yml) is intentionally deferred to a separate PR so it can go through the normal E2E workflow gating.

Sources consulted: Splunk advisory.splunk.com (via web search), endoflife.date/splunk, help.splunk.com release notes (10.0–10.4), GitHub Advisory Database, Snyk, CVEdetails.com.

---

Generated by Claude Code