Codex/fix dependency cves july 2026 - #164
Conversation
There was a problem hiding this comment.
Pull request overview
This PR updates dependency pins/overrides to address July 2026 CVEs across the JS (ui, extension) and Python (workflows) components, and adds documentation to support the new progress-tracking capability.
Changes:
- Python: add/adjust
uvconstraint + override dependencies and refreshuv.lockto land on patched transitive versions (e.g.,aiohttp,pillow,pypdf,idna). - Docs: add quick-start and detailed guides/summaries for workflow-generation progress tracking.
- JavaScript: add
overridesto pin patched versions and update lockfiles accordingly.
Reviewed changes
Copilot reviewed 7 out of 10 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| workflows/uv.lock | Refreshes locked Python dependency set; introduces overrides section and updates resolved versions. |
| workflows/pyproject.toml | Adds new constraint and override floors for vulnerable transitive Python deps under [tool.uv]. |
| workflows/QUICK_START_PROGRESS_TRACKING.md | Adds a quick-start guide for progress tracking usage patterns. |
| workflows/docs/PROGRESS_TRACKING.md | Adds a detailed progress-tracking reference and examples. |
| workflows/IMPLEMENTATION_SUMMARY.md | Provides an implementation summary for the progress tracking feature. |
| workflows/BUGFIX_SUMMARY.md | Documents fixes and file moves related to the progress tracking docs/tests/examples. |
| ui/package.json | Adds npm overrides to force patched transitive versions. |
| ui/package-lock.json | Updates resolved versions/integrity metadata for patched packages. |
| extension/package.json | Adds npm overrides to force patched transitive versions (incl. uuid). |
| extension/package-lock.json | Updates resolved versions/integrity metadata for patched packages. |
Files not reviewed (2)
- extension/package-lock.json: Generated file
- ui/package-lock.json: Generated file
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9214eb8fc5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| override-dependencies = [ | ||
| # CVE-2026-34993 / CVE-2026-47265 / CVE-2026-54273 / CVE-2026-54274 / | ||
| # CVE-2026-54276 / CVE-2026-54277 / CVE-2026-54278 (<= 3.14.0) | ||
| "aiohttp>=3.14.1", |
There was a problem hiding this comment.
When users install the published workflow-use wheel rather than syncing this checkout, these overrides are not applied: [tool.uv] configuration only affects uv's local resolution and is not emitted into the wheel's Requires-Dist metadata, which is derived from [project].dependencies. Since that metadata still contains only browser-use==0.13.4, whose incompatible vulnerable pins prompted these overrides, downstream pip/uv installs can continue receiving the vulnerable aiohttp, Pillow, and pypdf versions; the remediation needs to be represented in publishable dependencies or by upgrading browser-use.
Useful? React with 👍 / 👎.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 10 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="workflows/pyproject.toml">
<violation number="1" location="workflows/pyproject.toml:55">
P1: Installing the published wheel with pip or another resolver still accepts browser-use 0.13.4's vulnerable exact transitive pins; these uv-only overrides protect only this repository's uv resolution. Publish enforceable requirements (or update browser-use to a release with patched requirements) so the CVE fix reaches package consumers.</violation>
</file>
Tip: instead of fixing issues one by one fix them all with cubic
Re-trigger cubic
| override-dependencies = [ | ||
| # CVE-2026-34993 / CVE-2026-47265 / CVE-2026-54273 / CVE-2026-54274 / | ||
| # CVE-2026-54276 / CVE-2026-54277 / CVE-2026-54278 (<= 3.14.0) | ||
| "aiohttp>=3.14.1", |
There was a problem hiding this comment.
P1: Installing the published wheel with pip or another resolver still accepts browser-use 0.13.4's vulnerable exact transitive pins; these uv-only overrides protect only this repository's uv resolution. Publish enforceable requirements (or update browser-use to a release with patched requirements) so the CVE fix reaches package consumers.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At workflows/pyproject.toml, line 55:
<comment>Installing the published wheel with pip or another resolver still accepts browser-use 0.13.4's vulnerable exact transitive pins; these uv-only overrides protect only this repository's uv resolution. Publish enforceable requirements (or update browser-use to a release with patched requirements) so the CVE fix reaches package consumers.</comment>
<file context>
@@ -43,8 +43,23 @@ constraint-dependencies = [
+override-dependencies = [
+ # CVE-2026-34993 / CVE-2026-47265 / CVE-2026-54273 / CVE-2026-54274 /
+ # CVE-2026-54276 / CVE-2026-54277 / CVE-2026-54278 (<= 3.14.0)
+ "aiohttp>=3.14.1",
+ # CVE-2026-25990 / CVE-2026-40192 / CVE-2026-42311 / CVE-2026-55798 /
+ # CVE-2026-59198 / CVE-2026-59203 (< 12.3.0)
</file context>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7e84cbbbb5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| workflow.generation_metadata['steps'].append(step_data) | ||
| await session.commit() |
There was a problem hiding this comment.
With the schema shown in this guide (Column(JSON)), SQLAlchemy does not detect these in-place mutations of a nested list, so the step callback can commit without issuing an update to generation_metadata; the status-history append has the same problem. Users following this backend implementation will retain the initially empty metadata instead of recorded progress unless the code assigns a new metadata object or configures mutable JSON tracking.
Useful? React with 👍 / 👎.
| def schedule_db_write(data: dict) -> None: | ||
| asyncio.create_task(store_in_db(data)) |
There was a problem hiding this comment.
When this documented pattern is run as a top-level coroutine (for example through asyncio.run(generate())) or near the end of a request, generate() returns without retaining or awaiting the task created here, allowing the event loop or request scope to close and cancel an unfinished database write. Track these tasks and await them before returning, as the earlier example in this guide does, or progress records can be silently lost.
Useful? React with 👍 / 👎.
| def schedule_step(data: dict) -> None: | ||
| pending_tasks.append(asyncio.create_task(step_callback(data))) | ||
|
|
||
| def schedule_status(status: str) -> None: | ||
| pending_tasks.append(asyncio.create_task(status_callback(status))) |
There was a problem hiding this comment.
In the Browser-Use Cloud backend example, every step and status callback is launched as an independent task, and each task opens its own session to perform a read-modify-write on the same generation_metadata value. When callbacks overlap, multiple sessions can read the same prior metadata and later commits overwrite one another, dropping steps or status entries; use a single consumer/lock or atomic database updates rather than running these writers concurrently.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 10 out of 13 changed files in this pull request and generated no new comments.
Files not reviewed (2)
- extension/package-lock.json: Generated file
- ui/package-lock.json: Generated file
Comments suppressed due to low confidence (2)
workflows/workflow_use/healing/service.py:34
_emit_status_updateprints callback exceptions to stdout and drops the traceback, which can spam users (especially if callbacks fail repeatedly) and makes debugging harder. Prefer using the module logger withexc_info=True(and include the status value) so consumers can route/disable these warnings via logging configuration.
def _emit_status_update(callback: Optional[StatusUpdateCallback], status: str) -> None:
"""Fire a status callback without allowing callback failures to stop generation."""
if callback is None:
return
try:
callback(status)
except Exception as e:
print(f'⚠️ Warning: Failed to fire status update callback: {e}')
workflows/QUICK_START_PROGRESS_TRACKING.md:193
- The
on_status_updateexample list doesn’t match the actual status strings emitted byHealingService(it never emits the generic "Converting steps to workflow..."; it emits either the deterministic or AI-specific message, and also emits the post-processing status). Updating the list to the exact messages avoids confusion for integrators who key off these strings.
"Recording workflow steps..."
"Completed recording N steps"
"Converting steps to workflow..."
"Workflow generation complete!"
</details>
There was a problem hiding this comment.
1 issue found across 7 files (changes from recent commits).
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="workflows/BUGFIX_SUMMARY.md">
<violation number="1" location="workflows/BUGFIX_SUMMARY.md:212">
P2: The verification commands section is now inconsistent: the ls checks and py_compile command assume the user is at the repository root, but the two uv run python tests/... commands do not include --directory workflows, so they will fail when run from the repo root. Add --directory workflows to those commands to keep the section self-consistent.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Fix all with cubic | Re-trigger cubic
| ls -lh workflows/IMPLEMENTATION_SUMMARY.md | ||
|
|
||
| # Verify code compiles | ||
| uv run --directory workflows python -m py_compile workflow_use/healing/service.py |
There was a problem hiding this comment.
P2: The verification commands section is now inconsistent: the ls checks and py_compile command assume the user is at the repository root, but the two uv run python tests/... commands do not include --directory workflows, so they will fail when run from the repo root. Add --directory workflows to those commands to keep the section self-consistent.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At workflows/BUGFIX_SUMMARY.md, line 212:
<comment>The verification commands section is now inconsistent: the ls checks and py_compile command assume the user is at the repository root, but the two uv run python tests/... commands do not include --directory workflows, so they will fail when run from the repo root. Add --directory workflows to those commands to keep the section self-consistent.</comment>
<file context>
@@ -198,13 +203,13 @@ uv run python tests/test_progress_tracking.py
# Verify code compiles
-uv run python -m py_compile workflow_use/healing/service.py
+uv run --directory workflows python -m py_compile workflow_use/healing/service.py
</file context>
</details>
<a href="https://www.cubic.dev/action/fix/violation/aac778c4-f5e4-4d62-9545-1d2e90a9ef35" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true">
<picture>
<source media="(prefers-color-scheme: dark)" srcset="https://cubic.dev/buttons/fix-with-cubic-dark.svg">
<source media="(prefers-color-scheme: light)" srcset="https://cubic.dev/buttons/fix-with-cubic-light.svg">
<img alt="Fix with cubic" src="https://cubic.dev/buttons/fix-with-cubic-dark.svg">
</picture>
</a>
Summary by cubic
Patches July 2026 dependency CVEs across
extension,ui, andworkflows. Finalizes progress tracking with safe status callbacks and improved examples/tests.Dependencies
js-yaml4.3.0,picomatch@22.3.2,postcss8.5.24,nanoid3.3.16,uuid11.1.1; updated lockfiles.extension/package.jsonandui/package.jsonto pin patched versions (js-yaml,picomatch@2,postcss, plusuuidin extension).pyproject.toml(e.g.,soupsieve>=2.8.4,idna>=3.15) and overrides for pinned-but-vulnerable deps:aiohttp>=3.14.1,pillow>=12.3.0,pypdf>=6.14.0; refresheduv.lock.workflows/docs/PROGRESS_TRACKING.md,IMPLEMENTATION_SUMMARY.md,QUICK_START_PROGRESS_TRACKING.md, andBUGFIX_SUMMARY.mdto guide progress-tracking usage and context.Bug Fixes
_emit_status_updateto isolate status callback failures and used it acrossservice.py.on_step_recordedis not provided, ensuring correct “Completed recording N steps” messages._emit_status_updateand verify exception isolation; examples now schedule async callbacks viaasyncio.create_taskand await pending tasks.Written for commit 7e84cbb. Summary will update on new commits.