[nv-rag-cve-bot]

Security: 25 CVE fixes for NSPECT-S62Q-PZUD (collection)

nSpect program: NSPECT-S62Q-PZUD (collection → NSPECT-UV6I-R3V9 container + NSPECT-O8B9-SHZ8 helm)
Version scoped: 26.05.2 / 2.6.0.rc1
Track: A — Verified fix (pip-audit + pnpm lockfile confirmed)
Validation mode: --validate pipeline (§5b/§5c/§5d gating via CI Phase 9)

Changes

Python (pyproject.toml + uv.lock)

• fastapi ≥0.133.0 (unlocks starlette 1.x; removes starlette upper bound)
• bleach ≥6.4.0 — GHSA-gj48-438w-jh9v / GHSA-8rfp-98v4-mmr6
• langchain ≥1.3.9 — CVE-2026-55443 / GHSA-gr75-jv2w-4656
• langchain-core ≥1.4.6 — API chain requirement
• python-multipart ≥0.0.31 — CVE-2026-53539/53540
• setuptools ≥83.0.0 — CVE-2026-59890 / GHSA-h35f-9h28-mq5c
• Transitive overrides: cryptography ≥50.0.0, pillow ≥12.3.0, aiohttp ≥3.14.3, langsmith ≥0.8.18, starlette ≥1.3.1, click ≥8.3.3, langgraph-sdk ≥0.3.15, pydantic-settings ≥2.14.2

Frontend (package.json + pnpm-lock.yaml)

• react-router-dom ^7.18.2 — GHSA-qwww-vcr4-c8h2
• vite ^6.4.3 — GHSA-fx2h-pf6j-xcff / GHSA-v6wh-96g9-6wx3
• vitest ^3.2.7 — GHSA-5xrq-8626-4rwp
• pnpm overrides: brace-expansion@1 ≥1.1.18, brace-expansion@2 ≥2.1.4, js-yaml@4 ≥4.3.1, postcss ≥8.5.23, tar@7 ≥7.5.21, glob@10 ≥10.5.0, ws@8 ≥8.21.0

Tests (tests/unit/test_security_dependency_pins.py)

• 17 version-pin regression tests; all passing

Validation

Step	Result
pip-audit re-scan	✅ exit 0 — no known vulnerabilities
pnpm lockfile resolved versions	✅ all patched versions confirmed
Security regression tests (17/17)	✅ passed
unit-tests (CI)	⏳ pending
frontend-unit-tests (CI)	⏳ pending
static-analysis (CI)	⏳ pending
integration-tests — GPU chain (CI)	⏳ pending (--ci-wait-gpu)

Deferred (Track C — base-image)

OS-level OpenSSL CVEs in container base images deferred. Re-run with --include-base-image to address.

Notes for reviewers

• fastapi bump from 0.115 → 0.133 introduces strict_content_type=True default (FastAPI 0.132). All frontend POST calls already set Content-Type: application/json. No breaking change for existing consumers.
• starlette resolves to 1.6.0 (major version). Confirmed compatible: fastapi 0.141.1 only requires starlette>=0.46.0, no upper cap. Direct starlette imports (Response, HTTP_422_UNPROCESSABLE_ENTITY) are unchanged.
• Four pnpm overrides (nanoid@3, brace-expansion@1/2, tar@7) are forward-safety guards — the packages are not currently in the resolved tree but the overrides activate if they re-enter.
• Report: cve-fix-reports/NSPECT-S62Q-PZUD-20260816-023737/ (local-only, not committed)

🤖 Generated by agentic-cve-fix | Refs: NSPECT-S62Q-PZUD

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.