-
Notifications
You must be signed in to change notification settings - Fork 0
a11y(frontend): keep unavailable export actions discoverable #698
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
363065e
61f3d9f
edb1446
3ffa88d
fbb649c
387db9d
a150b48
bc8aaa0
2ca586c
1a01888
6bd0d2c
61d5c44
bc38c8e
bb8306c
8115635
68bc6c7
3cc9e80
f94a797
bb261ba
d6df242
f844204
8cf7c26
90cdcbd
60fa219
2a6ace9
0a5b86f
00eb793
d57b54f
9f1118f
143e17b
a9a7b1a
66afc79
bfe0c13
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -20,7 +20,7 @@ dependencies = [ | |
| "asyncpg>=0.31.0", | ||
| "psycopg[binary]>=3.3.4", | ||
| "alembic>=1.18.5", | ||
| "cryptography>=50.0.0", | ||
| "cryptography>=46.0.7", | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🟥 Cryptography downgrade reintroduces a patched CVE The cryptography floor drops from Was this helpful? React with 👍 or 👎 to provide feedback. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 취약한
현재 #!/usr/bin/env bash
set -euo pipefail
python - <<'PY'
from pathlib import Path
import re
minimum = (48, 0, 1)
pyproject = Path("backend/pyproject.toml").read_text()
match = re.search(r'cryptography>=([0-9.]+)', pyproject)
if not match:
raise SystemExit("cryptography minimum is missing")
version = tuple(map(int, match.group(1).split(".")))
if version < minimum:
raise SystemExit(f"cryptography minimum is too low: {match.group(1)}")
for name in ("requirements.lock", "requirements-dev.lock"):
path = Path("backend") / name
matches = re.findall(r"(?m)^cryptography==([0-9.]+)", path.read_text())
if not matches:
raise SystemExit(f"missing cryptography pin: {path}")
if any(tuple(map(int, value.split("."))) < minimum for value in matches):
raise SystemExit(f"vulnerable cryptography pin in {path}")
print("cryptography constraints are at least 48.0.1")
PY수정 예시- "cryptography>=46.0.7",
+ "cryptography>=48.0.1",As per coding guidelines: vulnerable Python dependencies must be remediated in 🤖 Prompt for AI AgentsSources: Coding guidelines, MCP tools |
||
| "httpx>=0.28.1", | ||
| "python-jose[cryptography]>=3.5.0", | ||
| "redis>=5.0.0", | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔍 PR reverts many files beyond the stated a11y scope
The description claims the diff is four files, but it also reverts
harden-runner, downgradescryptography50.0.0->49.0.0 (pyproject + both lockfiles), downgrades node 26.7.0->26.5.0 in both Dockerfiles, downgrades several package.json deps, and deletes the sequential-polling doc and test while reverting the App.tsx polling work. This resembles a stale branch regressingmainrather than a focused change.Was this helpful? React with 👍 or 👎 to provide feedback.