fix(security): bump yt-dlp, setuptools, torch to patched releases by seonghobae · Pull Request #1033 · ContextualWisdomLab/bandscope

seonghobae · 2026-08-25T23:00:09Z

Security Notes

Repairs the current Python dependency baseline on protected develop@7ad56cf0065d068ec6463d92726de4855a6e201d and adds regression evidence so retired exceptions cannot silently return.

setuptools is locked to 84.0.0; GHSA-h35f-9h28-mq5c is fixed at >=83.0.0.
torch is locked to 2.13.0; GHSA-rrmf-rvhw-rf47 affects <=2.12.1. The older GHSA-53q9-r3pm-6pq6 exception is retired rather than carried forward.
yt-dlp is advanced to 2026.8.19 as forward hardening of the remote-media boundary. GHSA-6v4j-43gg-vj32 was already fixed in 2026.7.4, so the newer floor is not presented as the advisory's patched minimum.

The analysis-engine manifest intentionally excludes Demucs on macOS Intel (darwin non-arm64); that required packaging target therefore does not install Demucs/torch and is not a reason to retain a vulnerable torch exception.

Regression-first repair

26149df2a37c9a471521e011590fdd144d842036 added deterministic policy/lock regressions before the policy repair. The new tests reject the obsolete torch 2.2.2 exception and stale references to non-existent repo-local Python exception files while pinning the patched lock versions and the macOS Intel exclusion contract.
b49f3a773a23d6668a9acb83fe36abfb25b42caa retired the obsolete Python exception text and records the exact advisory floors/current locks.
7fd551d227dc4b5a4e2c46fb18c71f5b7f472a8f records the Python security baseline in CHANGELOG.md.

Hosted RED was not observed before the successor repair commits, so predecessor queued runs are not counted as RED/GREEN evidence. Only terminal checks on the unchanged current exact head count for merge readiness.

Untrusted-input context: yt-dlp processes remote YouTube metadata and media streams during policy-constrained import. No new network capability is added. torch remains transitive through Demucs only on platforms admitted by the existing manifest marker.

Do not merge until current exact-head CI, dependency/security audit, SBOM, SAST, release/build gates, central OpenCode/Noema/Strix/coverage gates, unresolved review state, and a qualifying independent non-author last-push approval all pass.

Summary by CodeRabbit

보안 및 유지보수
- Python 분석 환경의 보안 의존성 기준을 업데이트했습니다.
- torch, setuptools, yt-dlp를 보안 수정 버전으로 고정했습니다.
- macOS Intel에서는 Demucs와 Torch를 설치하지 않는 지원 정책을 유지합니다.
테스트
- 의존성 버전과 플랫폼별 보안 정책을 자동으로 검증하는 회귀 테스트를 추가했습니다.
문서
- 최신 의존성 기준과 취약점 예외 변경 사항을 기록했습니다.

Remediates the three open Dependabot alerts on develop: - GHSA-6v4j-43gg-vj32 (HIGH, yt-dlp < 2026.7.4): floor raised to the latest 2026.8.19 release ahead of the advisory window. - GHSA-h35f-9h28-mq5c (MEDIUM, setuptools < 83.0.0): transitive pin refreshed to 84.0.0 through the lockfile. - torch <= 2.12.1 (LOW): demucs's torch dependency updated to 2.13.0. uv.lock regenerated with uv's own resolver; full analysis-engine suite passes (679 passed, 24 skipped) on Python 3.14.

coderabbitai · 2026-08-25T23:00:22Z

Warning

Review limit reached

Next included review available in 29 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5826be48-baa3-4f6a-9c2b-f2f2f40e6099

📥 Commits

Reviewing files that changed from the base of the PR and between 3a04805 and 046db56.

📒 Files selected for processing (2)

CHANGELOG.md
services/analysis-engine/tests/test_python_dependency_security_baseline.py

📝 Walkthrough

Walkthrough

Python 분석 의존성 기준을 갱신했습니다. torch, setuptools, yt-dlp의 버전 기준과 보안 예외를 변경했습니다. macOS Intel의 Demucs 및 torch 제외 정책을 명시했습니다. 관련 기준을 검증하는 회귀 테스트를 추가했습니다.

Changes

Python 의존성 보안 기준선

Layer / File(s)	Summary
의존성 및 보안 정책 갱신 `services/analysis-engine/pyproject.toml`, `docs/security/dependency-policy.md`, `CHANGELOG.md`	`yt-dlp` 최소 버전을 `2026.8.19`로 변경했습니다. `torch`와 `setuptools`의 고정 버전 및 보안 예외 상태를 갱신했습니다. macOS Intel에서 Demucs와 `torch`를 설치하지 않는 정책을 기록했습니다.
보안 기준 회귀 테스트 `services/analysis-engine/tests/test_python_dependency_security_baseline.py`	`setuptools`, `torch`, `yt-dlp`의 lockfile 버전을 검증합니다. Demucs 플랫폼 조건, 보안 예외 제거, Trivy 예외, `yt-dlp` 수정 기준을 검증합니다.

Estimated code review effort: 2 (Simple) | ~15 minutes

Merge Risk: 🔵 Low · up to 3a048

The dependency baseline is updated to patched releases, but the regression test does not directly verify that torch remains excluded on macOS Intel. The PR is mergeable with explicit owner awareness or a follow-up to assert that platform condition.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 보안 기준선 변경의 핵심인 yt-dlp, setuptools, torch의 패치 릴리스 업데이트를 정확히 요약합니다.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 1 files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/python-dep-cves-ytdlp-setuptools-torch

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

devin-ai-integration

Devin Review found 0 potential issues.

devin-ai-integration