From cce3c49499c78e5a30539d7c881e97579a704263 Mon Sep 17 00:00:00 2001 From: JuliaEdom Date: Mon, 20 Jul 2026 22:19:23 +0300 Subject: [PATCH] chore(security): drop stale safety ignore 88512, add Flink-manifest dependabot watchdog - safety: PyUp corrected the 88512 cross-ecosystem false positive (verified 2026-07-20: 0 findings on the pinned langchain stack), so the ignore is removed and any resurfacing fails the job loudly. - The remaining pyarrow ignore (SFTY-20260217-93940) is requalified from "latent bump task" to "blocked upstream": apache-flink 2.3.0 is the newest PyPI release and its beam chain cannot reach pyarrow 23.0.1. - dependabot: the Flink runtime manifest (src/processing/flink_jobs) was in no pip ecosystem entry, so the apache-flink release that unblocks the ignore would go unnoticed. Add a weekly pip entry as the watchdog. - .gitignore: /grok_task_*.md joins the root-level session-notes guard. Co-Authored-By: Claude Fable 5 --- .github/dependabot.yml | 24 ++++++++++++++++++++++++ .github/workflows/security.yml | 20 ++++++++++++-------- .gitignore | 2 ++ 3 files changed, 38 insertions(+), 8 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 7bf83c4b..3a5e2db1 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -65,6 +65,30 @@ updates: - dependency-name: "dagster" update-types: ["version-update:semver-major"] + # ── Python: Flink runtime image manifest ─────────────────────────── + # Not an extra of the root project (its beam chain can never co-install + # with core pyarrow>=17 — see the manifest header), so it needs its own + # pip entry or new apache-flink releases go unnoticed. This is the + # watchdog for the pyarrow safety-ignore (SFTY-20260217-93940 in + # security.yml): the ignore is blocked on the next apache-flink release + # raising the beam/pyarrow chain, and that release must open a PR here. + # apache-flink majors/minors stay individual PRs by default (no group), + # matching the deliberate-bump policy for the Flink line. + - package-ecosystem: pip + directory: "/src/processing/flink_jobs" + schedule: + interval: weekly + day: monday + time: "06:00" + timezone: Europe/Moscow + open-pull-requests-limit: 3 + commit-message: + prefix: "chore(deps,flink)" + labels: + - dependencies + - python + - flink + # ── Python: SDK (agentflow-client) ───────────────────────────────── - package-ecosystem: pip directory: "/sdk" diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 4869b17f..f055f9de 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -197,11 +197,6 @@ jobs: fi - name: Run Safety run: | - # 88512: Cross-ecosystem false positive — PyUp advisory text - # references @langchain/google-cloud-sql-pg (npm) but is matched - # against Python langchain<1.2.24, which does not exist (latest is - # 1.2.15). Remove this ignore when PyUp corrects the entry. - # # SFTY-20260217-93940 (CVE-2026-25087): pyarrow use-after-free when # decoding malformed IPC files, fixed in 23.0.1. Only the Flink # runtime bucket is affected: apache-flink's beam chain caps @@ -209,10 +204,19 @@ jobs: # image and every extra run pyarrow>=23.0.1 via uv.lock, gated by # pip-audit). The Flink jobs only exchange Arrow IPC that beam # itself produces inside the pipeline, never operator-supplied IPC - # files. Remove when apache-flink/beam raise their pyarrow floor - # past 23.0.1. + # files. Blocked upstream, not by our pin: apache-flink 2.3.0 is + # the newest PyPI release (checked 2026-07-20) and itself caps + # pyarrow<21; beam accepts pyarrow<24 only from 2.75.0, which no + # released apache-flink allows. Dependabot watches the Flink + # manifest (src/processing/flink_jobs), so the next apache-flink + # release opens a PR — re-check this ignore there. Remove when the + # resolved flink-runtime bucket installs pyarrow>=23.0.1. + # + # 88512 (langchain cross-ecosystem false positive) was ignored here + # until 2026-07-20; PyUp corrected the entry (verified: safety + # 2.3.5 reports 0 findings on the pinned langchain stack), so the + # ignore is gone. If it ever resurfaces, it fails this job loudly. safety check \ - --ignore 88512 \ --ignore SFTY-20260217-93940 \ -r .tmp-security/requirements-main.txt \ -r .tmp-security/requirements-sdk.txt \ diff --git a/.gitignore b/.gitignore index dbd971d0..9cfeb10a 100644 --- a/.gitignore +++ b/.gitignore @@ -90,6 +90,8 @@ mutants/ /autdit_*.md # Root-level planning notes are session scratch, not product docs. /plan_*.md +# Task specs handed to external review models (Grok etc.) — session kitchen. +/grok_task_*.md # Session handoff for the next agent: working notes, not product docs. Untracked # but unignored is one `git add -A` away from a public repo, so name it. /_NEXT_SESSION.md