[nv-rag-cve-bot]

Security: 7 CVE fixes for NSPECT-S62Q-PZUD

Summary

CVE	Severity	Surface	Package	Fix	Track	Validation
aiohttp cluster (11 CVEs)	High	source	aiohttp 3.13.5→3.14.1	manifest+lockfile bump	A	OSV re-scan clean
GHSA-537c-gmf6-5ccf	High 7.5	source	cryptography 48.0.0→49.0.0	manifest+lockfile bump	A	OSV re-scan clean
GHSA-f4xh-w4cj-qxq8	High 7.7	source	langsmith 0.8.5→0.9.5	manifest+lockfile bump	A	OSV re-scan clean
BDSA-2026-15484/15486	High	source	bleach 6.3.0→6.4.0	manifest+lockfile bump	A	OSV re-scan clean
CVE-2026-48776	Critical (nSpect)/Med 4.2 (NVD)	source	langgraph-sdk 0.3.3→0.4.2	manifest+lockfile bump	A	OSV re-scan clean
GHSA-5rvq-cxj2-64vf	High 7.5	source	python-multipart 0.0.29→0.0.32	manifest+lockfile bump	A	OSV re-scan clean
GHSA-5xrq-8626-4rwp	Critical 9.8	source	vitest 3.2.4→≥3.2.6	package.json+lockfile bump	A	advisory confirmed fixed

Validation

Local validation

• Re-scan (local manifest): OSV API queries — all 6 Python packages and vitest clean at resolved versions
• Re-scan (nSpect source surface): pending nSpect re-ingest after merge
• Full CVE sweep: 3 residual HIGH vulns, all triaged in audit (starlette×2 NOT-FIXABLE, pyarrow NOT-FIXABLE — see "Not addressed" below)
• Unit tests: 13 security pin tests passed locally (pytest tests/unit/test_security_dependency_pins.py); full suite see CI gating jobs below
• Lint: see static-analysis below
• 5d deployment smoke: see deploy+basic-tests below (pipeline mode)

Pipeline validation (--validate pipeline)

• Pipeline: ⏳ pending — PR just opened (project chat-labs/OpenSource/rag, polled on GitLab mirror)
• Risk gating (Phase 9a): minor dep bumps (source only) + --ci-wait-gpu → full docker-tests chain gated
• Fix-loop iterations: 0 of 3

Gating jobs (block the loop):

Job	Status
static-analysis	⏳ pending
unit-tests	⏳ pending
frontend-unit-tests	⏳ pending (diff touches frontend/**)
deploy	⏳ pending
basic-tests	⏳ pending

🔴 GPU docker-tests chain (gated via --ci-wait-gpu): ⏳ pending

Not addressed in this MR

• starlette 0.50.0 / GHSA-82w8-qh3p-5jfq, GHSA-wqp7-x3pw-xc5r (HIGH) — NOT-FIXABLE: fix requires starlette ≥1.x; blocked by fastapi>=0.115.5,<1.0 constraint
• pyarrow 21.0.0 / GHSA-rgxp-2hwp-jwgg (HIGH) — NOT-FIXABLE: fix requires pyarrow ≥23.0.1; blocked by pyarrow>=21.0,<22.0 cap
• CVE-2025-68664 (langchain-core) — ALREADY-PATCHED: installed 1.4.0 > 1.2.5 fixed version
• CVE-2026-6100, CVE-2026-7210 — NOT-APPLICABLE: excepted via EXC-VI9G-363S / EXC-PLHM-395B
• Container base-image CVEs (golang/openssl/glibc/tarfile) — deferred; requires --include-base-image

Audit trail

The full per-CVE analysis, expert-review verdicts, and Phase 5 validation logs live in the agentic workspace:

cve-fix-reports/NSPECT-S62Q-PZUD-20260702-000000/
  ├── _summary.md
  ├── NSPECT-UV6I-R3V9/_by-repo/nvidia-rag.md
  ├── NSPECT-UV6I-R3V9/GHSA-537c-gmf6-5ccf-cryptography-fixed.md
  ├── NSPECT-UV6I-R3V9/aiohttp-cluster-fixed.md
  ├── NSPECT-UV6I-R3V9/GHSA-f4xh-w4cj-qxq8-langsmith-fixed.md
  ├── NSPECT-UV6I-R3V9/BDSA-2026-15484-bleach-fixed.md
  ├── NSPECT-UV6I-R3V9/CVE-2026-48776-langgraph-sdk-fixed.md
  ├── NSPECT-UV6I-R3V9/GHSA-5rvq-cxj2-64vf-python-multipart-fixed.md
  ├── NSPECT-UV6I-R3V9/GHSA-5xrq-8626-4rwp-vitest-fixed.md
  └── NSPECT-UV6I-R3V9/CVE-2025-68664-langchain-core-already-patched.md

This directory is not committed to the repository. Reviewers who need it can request the snapshot from the operator.

---

Refs: NSPECT-S62Q-PZUD NSPECT-UV6I-R3V9
Generated by: agentic-cve-fix

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[nv-rag-cve-bot]

Phase 9 fix-loop iteration 1/3: Frontend Unit Tests failed on run 1 with ERR_PNPM_OUTDATED_LOCKFILE — pnpm lockfile had stale specifiers (^3.2.4) after package.json was bumped to ^3.2.6. Fixed by regenerating pnpm-lock.yaml with pnpm install --no-frozen-lockfile. Commit e65f01fb pushed; new CI run 28561413450 started.