[rawwerks]

Opened by Claude Code (an AI agent) on behalf of @rawwerks.

Security impact: these fixes are in the binaries we ship to users. The bundled certifi CA store still trusted roots whose intermediate keys are compromised, so the SDK helper could accept a forged TLS certificate. prose-bun carried fast-uri host-confusion bugs, and prose-rust an older rustls. Users get the fixes with the next release.

Why

An osv-scanner 2.7.0 sweep on 2026-10-21 reported 2 critical and 30 high findings in this repo. Most of them are in cli/labs/bun (not shipped) or come from osv's transitive guess for harnesses/agents-sdk/requirements.txt. The real build lock is requirements-build.txt, and it already pins fixed httpx2 2.13.1 and requests 2.34.2. Three locks do end up in released artifacts (standalone archives, npm platform packages and Homebrew), and each had a finding:

Shipped artifact	Lock	Finding
prose-agents-sdk (PyInstaller helper, --collect-all certifi)	harnesses/agents-sdk/requirements-build.txt	critical certifi emSign roots with compromised intermediate keys (GHSA-6q48-6c7w-9gw2); high cryptography
prose-bun	cli/bun/bun.lock	high fast-uri host confusion / authority injection (via ajv)
prose-rust	cli/rust/Cargo.lock	rustls, rustls-webpki, webpki-roots (emSign distrust; low/medium)

What changed

• certifi 2026.7.22 → 2026.10.18 in harnesses/agents-sdk/requirements-build.txt, with the hash checked against PyPI. 2026.10.18 removes every emSign root, so the compromised intermediates no longer chain. 2026.10.19 later restored the emSign roots that were not affected. osv still marks 2026.10.18 as affected because its fixed version is 2026.10.19. 2026.10.19 was uploaded 2026-10-20 02:24 UTC, so it is inside our 72-hour supply-chain cooldown.
• fast-uri 3.1.6 → 3.1.8 in cli/bun/bun.lock. This is the lock entry only; ajv's ^3.0.1 range already allows it. 3.1.9 is inside the cooldown.
• rustls 0.23.45 → 0.23.46 in cli/rust/Cargo.lock (cargo update -p rustls --precise 0.23.46). This fixes RUSTSEC-2026-0346 through 0349.

No manifest or source changes. The SDK lock digest is computed at build time, so no evidence file needs regenerating.

Verification

Run with the pinned toolchain: Bun 1.3.5, Rust 1.87.0, CPython 3.10.20 and cli/ci/requirements-test.txt. check_dependencies.py passes.

• pip install --require-hashes --only-binary=:all: -r harnesses/agents-sdk/requirements-build.txt on CPython 3.10 macOS arm64 succeeds. import agents, openai, certifi and ssl.create_default_context(cafile=certifi.where()) work. The bundle has 117 roots and no emSign entries.
• cli/bun: bun install --frozen-lockfile accepts the new integrity, and typecheck passes. bun test via the bun-tests gate: 887 pass, 0 fail. bun-build and bun-typecheck gates pass.
• cli/rust: cargo build --release --locked passes. cargo test --locked --no-fail-fast passes except 3 credential_store_macos keychain tests. Those 3 also fail on unmodified main on this machine, so they depend on the machine rather than on this change.
• python3 cli/ci/run_local.py --quick passed every gate from local-runner-tests through rust-clippy, including publication-contract, dependency-contract, dependency-evidence, workflow-policy and image-bundle. It then stopped at rust-tests. On unmodified main, the same gate fails the same 4 cli.rs harness-adapter tests on this machine. One extra test (prime_and_omp_preflight_…) failed once under load and passed twice on both branch and main when rerun alone.
• These gates were then run individually with --only and all pass: rust-build, package-lifecycle, bun-typecheck, bun-tests, bun-build, service-operations-rust-build, service-operations-bun-build and public-surface-files.

Not run: the full (non-quick) run_local.py, the PyInstaller freeze, the Linux/macOS-x64 candidates, and the kernel-RC workflow. CI and cli-kernel-rc.yml should cover them.

Left out, and why

• rustls-webpki 0.103.16 (published 2026-10-20 08:58 UTC) and webpki-roots 1.0.10 (2026-10-19 20:11 UTC) fix the same emSign distrust issue for prose-rust. Both are inside the 72-hour cooldown. A follow-up can take them after roughly 2026-10-23 09:00 UTC, using cargo update -p rustls-webpki --precise 0.103.16 -p webpki-roots@1.0.9 --precise 1.0.10. certifi 2026.10.19 is eligible after 2026-10-23 02:24 UTC.
• cryptography 48.0.1 (PKCS#7 Bleichenbacher oracle; X.509 verifier issues; fixed in 49/50). Starting with 49, there are no macOS x86_64 wheels, and the build installs --only-binary=:all: for darwin-x64. The lock comment already notes this. In the helper, cryptography is only reached through mcp, which uses AES-GCM/HKDF and PyJWT, not PKCS#7 decryption or X.509 path building. A maintainer has to decide between dropping darwin-x64 for the helper, building from source, or accepting the risk.
• cli/labs/bun (MCP SDK, sharp 0.34.5, undici 7.29.0, proxy-addr, adm-zip and others), the experiments/weave-seed Cargo locks and the conformance/CI requirements-test.txt files are labs, experiments and test harnesses. None of them goes into a release artifact.
• harnesses/agents-sdk/requirements.txt findings (httpx2 2.9.1, requests 2.9.2) are false positives. osv resolved transitive versions that the hash-locked build lock does not use.

Follow-ups outside this PR

• Users only get these fixes in a new release candidate. Published 0.15.0-rc.3 (Homebrew tap and npm rc) and latest 0.14.0 still contain the old versions.

🤖 Generated with Claude Code