From bf2e5aad8c070722f5024dbff8b04a1beec271ba Mon Sep 17 00:00:00 2001 From: Gerald Fruhmann Date: Thu, 9 Jul 2026 10:21:24 +0200 Subject: [PATCH 1/2] fix(ci): suppress gosu CVE-2026-27145 in backup Trivy scan MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit New Go stdlib CVE (crypto/x509 DoS, HIGH) in the pre-compiled gosu binary shipped by upstream postgres:16-alpine — same accepted-risk class as the 15 CVEs already listed. gosu is unused (backup runs as postgres user), and the fix requires a newer Go toolchain only the upstream maintainers control. This unblocks the "CI OK" gate across the open dependency PRs. Co-Authored-By: Claude Opus 4.8 (1M context) --- backup/.trivyignore | 1 + 1 file changed, 1 insertion(+) diff --git a/backup/.trivyignore b/backup/.trivyignore index 39b7084..4ca4a08 100644 --- a/backup/.trivyignore +++ b/backup/.trivyignore @@ -18,3 +18,4 @@ CVE-2026-39825 CVE-2026-39836 CVE-2026-42499 CVE-2026-42504 +CVE-2026-27145 From 5cf117fca070b734ba9555c72c7b61d65a4c961b Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 23 Jun 2026 20:36:00 +0000 Subject: [PATCH 2/2] chore(deps): update dependency pydantic-settings to v2.14.2 [security] --- api/uv.lock | 8 ++++---- ml-service/uv.lock | 8 ++++---- sync-service/uv.lock | 8 ++++---- 3 files changed, 12 insertions(+), 12 deletions(-) diff --git a/api/uv.lock b/api/uv.lock index 7ecb433..9d8eb63 100644 --- a/api/uv.lock +++ b/api/uv.lock @@ -1025,7 +1025,7 @@ wheels = [ [[package]] name = "pulsebase-api" -version = "1.5.0" +version = "1.6.0" source = { virtual = "." } dependencies = [ { name = "asyncpg" }, @@ -1188,16 +1188,16 @@ wheels = [ [[package]] name = "pydantic-settings" -version = "2.14.1" +version = "2.14.2" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "pydantic" }, { name = "python-dotenv" }, { name = "typing-inspection" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/07/60/1d1e59c9c90d54591469ada7d268251f71c24bdb765f1a8a832cee8c6653/pydantic_settings-2.14.1.tar.gz", hash = "sha256:e874d3bec7e787b0c9958277956ed9b4dd5de6a80e162188fdaff7c5e26fd5fa", size = 235551, upload-time = "2026-05-08T13:40:06.542Z" } +sdist = { url = "https://files.pythonhosted.org/packages/5c/b5/8f48e906c3e0205276e8bd8cb7512217a87b2685304d64be27cad5b3019f/pydantic_settings-2.14.2.tar.gz", hash = "sha256:c19dd64b19097f1de80184f0cc7b0272a13ae6e170cbf240a3e27e381ed14a5f", size = 237700, upload-time = "2026-06-19T13:44:56.324Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/ae/8d/f1af3832f5e6eb13ba94ee809e72b8ecb5eef226d27ee0bef7d963d943c7/pydantic_settings-2.14.1-py3-none-any.whl", hash = "sha256:6e3c7edfd8277687cdc598f56e5cff0e9bfff0910a3749deaa8d4401c3a2b9de", size = 60964, upload-time = "2026-05-08T13:40:04.958Z" }, + { url = "https://files.pythonhosted.org/packages/77/c1/6e422f34e569cf8e18df68d1939c81c099d2b61e4f7d9621c8a77560799c/pydantic_settings-2.14.2-py3-none-any.whl", hash = "sha256:a20c97b37910b6550d5ea50fbcc2d4187defe58cd57070b73863d069419c9440", size = 61715, upload-time = "2026-06-19T13:44:55.02Z" }, ] [[package]] diff --git a/ml-service/uv.lock b/ml-service/uv.lock index 778772a..94bca65 100644 --- a/ml-service/uv.lock +++ b/ml-service/uv.lock @@ -430,7 +430,7 @@ wheels = [ [[package]] name = "pulsebase-ml" -version = "1.3.0" +version = "1.6.0" source = { virtual = "." } dependencies = [ { name = "apscheduler" }, @@ -564,16 +564,16 @@ wheels = [ [[package]] name = "pydantic-settings" -version = "2.14.1" +version = "2.14.2" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "pydantic" }, { name = "python-dotenv" }, { name = "typing-inspection" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/07/60/1d1e59c9c90d54591469ada7d268251f71c24bdb765f1a8a832cee8c6653/pydantic_settings-2.14.1.tar.gz", hash = "sha256:e874d3bec7e787b0c9958277956ed9b4dd5de6a80e162188fdaff7c5e26fd5fa", size = 235551, upload-time = "2026-05-08T13:40:06.542Z" } +sdist = { url = "https://files.pythonhosted.org/packages/5c/b5/8f48e906c3e0205276e8bd8cb7512217a87b2685304d64be27cad5b3019f/pydantic_settings-2.14.2.tar.gz", hash = "sha256:c19dd64b19097f1de80184f0cc7b0272a13ae6e170cbf240a3e27e381ed14a5f", size = 237700, upload-time = "2026-06-19T13:44:56.324Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/ae/8d/f1af3832f5e6eb13ba94ee809e72b8ecb5eef226d27ee0bef7d963d943c7/pydantic_settings-2.14.1-py3-none-any.whl", hash = "sha256:6e3c7edfd8277687cdc598f56e5cff0e9bfff0910a3749deaa8d4401c3a2b9de", size = 60964, upload-time = "2026-05-08T13:40:04.958Z" }, + { url = "https://files.pythonhosted.org/packages/77/c1/6e422f34e569cf8e18df68d1939c81c099d2b61e4f7d9621c8a77560799c/pydantic_settings-2.14.2-py3-none-any.whl", hash = "sha256:a20c97b37910b6550d5ea50fbcc2d4187defe58cd57070b73863d069419c9440", size = 61715, upload-time = "2026-06-19T13:44:55.02Z" }, ] [[package]] diff --git a/sync-service/uv.lock b/sync-service/uv.lock index 25f0b71..2f0c509 100644 --- a/sync-service/uv.lock +++ b/sync-service/uv.lock @@ -617,7 +617,7 @@ wheels = [ [[package]] name = "pulsebase-sync" -version = "1.3.0" +version = "1.6.0" source = { virtual = "." } dependencies = [ { name = "apscheduler" }, @@ -760,16 +760,16 @@ wheels = [ [[package]] name = "pydantic-settings" -version = "2.14.1" +version = "2.14.2" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "pydantic" }, { name = "python-dotenv" }, { name = "typing-inspection" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/07/60/1d1e59c9c90d54591469ada7d268251f71c24bdb765f1a8a832cee8c6653/pydantic_settings-2.14.1.tar.gz", hash = "sha256:e874d3bec7e787b0c9958277956ed9b4dd5de6a80e162188fdaff7c5e26fd5fa", size = 235551, upload-time = "2026-05-08T13:40:06.542Z" } +sdist = { url = "https://files.pythonhosted.org/packages/5c/b5/8f48e906c3e0205276e8bd8cb7512217a87b2685304d64be27cad5b3019f/pydantic_settings-2.14.2.tar.gz", hash = "sha256:c19dd64b19097f1de80184f0cc7b0272a13ae6e170cbf240a3e27e381ed14a5f", size = 237700, upload-time = "2026-06-19T13:44:56.324Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/ae/8d/f1af3832f5e6eb13ba94ee809e72b8ecb5eef226d27ee0bef7d963d943c7/pydantic_settings-2.14.1-py3-none-any.whl", hash = "sha256:6e3c7edfd8277687cdc598f56e5cff0e9bfff0910a3749deaa8d4401c3a2b9de", size = 60964, upload-time = "2026-05-08T13:40:04.958Z" }, + { url = "https://files.pythonhosted.org/packages/77/c1/6e422f34e569cf8e18df68d1939c81c099d2b61e4f7d9621c8a77560799c/pydantic_settings-2.14.2-py3-none-any.whl", hash = "sha256:a20c97b37910b6550d5ea50fbcc2d4187defe58cd57070b73863d069419c9440", size = 61715, upload-time = "2026-06-19T13:44:55.02Z" }, ] [[package]]