Commit History
8 days ago
-
security: extend the pillow 12.3.0 acceptances to 2026-12-18
avoigt1121 +1: Claude Opus 5.5The project lead decided 2026-11-03 ("Yes, extend", to "Extend the pillow acceptances to Fri 18 Dec?"): the 39 pillow 12.3.0 advisories accepted by id under fleet decision A (batches 1-8) now expire 2026-12-18, not 2026-11-20. Declined: forcing pillow 13 past gradio's pin, and freezing pushes (which would also block fixes like the 2026-11-01 joserfc bump). Only the expiry moves. security/accepted-vulns.txt changes the date on its 39 entries and nothing else (no id added or removed); tests/test_accepted_vulns.py raises its cap to 2026-12-18; security/ACCEPTED-FINDINGS.md gains one dated entry, earlier entries unchanged. The security addendum (docs/security/addendum-knowledge-specialist.md) states the expiry, and tests/test_host_table.py pins that statement: both now say 2026-12-18. Exposure re-check, 2026-11-03, on dev 9462c78 (44 commits since 2026-10-21): nil, unchanged. Inputs are identifiers only; no application code imports PIL, calls an image reader or reads a workbook (openpyxl…abc4da6
20 days ago
-
security: accept 1 more pillow 12.3.0 advisory until 2026-11-20 (batch 5)
avoigt1121 +1: Claude Opus 5.5GHSA-78g4-xqwv-q3g8 (high, no CVE id yet), published 2026-10-22 17:01 UTC after batch 4 and fixed only in pillow 13.0.0 (gradio 6.30 still requires pillow<13): a heap-buffer-overflow write in the libopenjp2 2.5.4 bundled in pillow wheels, reached by opening and loading a crafted JPEG 2000 file. No application code here opens JPEG 2000 or decodes a caller-supplied image. Accepted by id by the project lead (2026-10-22), same expiry and format as batches 1-4. Security files only; 35 pillow ids accepted; acceptance tests pass. The security-review addendum says 35, and tests/test_host_table.py now counts every accepted id (CVE, GHSA, PYSEC), not only CVE ids, so a GHSA-only advisory is counted. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>bd00037
21 days ago
-
security: accept 14 more pillow 12.3.0 advisories until 2026-11-20 (batch 2)
avoigt1121 +1: Claude Opus 5.5Published 2026-10-21 after batch 1 (D5-A), all fixed only in pillow 13.0.0. Same exposure: identifiers only, no image input. The addendum now states 22, and tests/test_host_table.py reads the count from security/accepted-vulns.txt instead of pinning it, so the next change cannot leave the addendum stale. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>e436d30 -
docs(security): the knowledge specialist's security-review addendum (s4)
avoigt1121 +1: Claude Opus 5.5docs/security/addendum-knowledge-specialist.md, in the review's own language: the eighth component, the hosts it calls (a table generated from config/sources.yaml by scripts/render_host_table.py), identifiers-only egress, the honest no-egress-filter sentence, and the controls. tests/test_host_table.py fails if the table is stale or any number the addendum states (tools, rates, timeouts, caps, TTLs, the pinned version, the accepted findings) stops matching the code, or if a person is named. A paste-ready version for the OHSU form lives beside the review in the business folder; filing it is the project lead's. Slice: phase1-knowledge-specialist/s4 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>a8943e8