Harden runtime scanning and CI posture

Author: SecAI-Hub

.github/scripts/audit-python-deps.py

@@ -10,9 +10,11 @@
 
 import datetime as dt
 import json
+import re
 import shutil
 import subprocess
 import sys
+import tempfile
 from pathlib import Path
 from typing import Any
 
@@ -25,6 +27,12 @@
     Path("services/quarantine/requirements.lock"),
 ]
 
+NO_DEPS_REQUIREMENT_FILES = [
+    (Path("files/scripts/diffusion-cuda.lock"), frozenset()),
+    (Path("files/scripts/diffusion-rocm.lock"), frozenset()),
+    (Path("files/scripts/diffusion-cpu.lock"), frozenset({"torch"})),
+]
+
 WAIVERS_FILE = Path(".github/vuln-waivers.json")
 
 
@@ -60,12 +68,39 @@ def extract_findings(data: Any) -> list[tuple[str, str, str]]:
     return findings
 
 
-def run_audit(req: Path) -> tuple[int, Any | None, str]:
+def strip_requirement_blocks(req: Path, package_names: frozenset[str]) -> Path:
+    """Return an auditable copy with selected pip-compile package blocks removed."""
+    if not package_names:
+        return req
+
+    package_re = re.compile(r"^([A-Za-z0-9_.-]+)==")
+    output = tempfile.NamedTemporaryFile(
+        "w",
+        encoding="utf-8",
+        delete=False,
+        prefix=f"{req.stem}-audit-",
+        suffix=".txt",
+    )
+    skip = False
+    with output:
+        for line in req.read_text(encoding="utf-8").splitlines():
+            match = package_re.match(line)
+            if match:
+                name = match.group(1).lower().replace("_", "-")
+                skip = name in package_names
+            if not skip:
+                output.write(line + "\n")
+    return Path(output.name)
+
+
+def run_audit(req: Path, *, no_deps: bool = False) -> tuple[int, Any | None, str]:
+    extra_args = ["--no-deps", "--disable-pip"] if no_deps else []
     proc = subprocess.run(
         [
             *pip_audit_cmd(),
             "--strict",
             "--desc",
+            *extra_args,
             "-r",
             str(req),
             "-f",
@@ -83,6 +118,45 @@ def run_audit(req: Path) -> tuple[int, Any | None, str]:
     return proc.returncode, data, stderr
 
 
+def audit_one(
+    req: Path,
+    waivers: set[str],
+    *,
+    no_deps: bool = False,
+    label: Path | None = None,
+) -> int:
+    display = label or req
+    code, data, stderr = run_audit(req, no_deps=no_deps)
+    if data is None:
+        print(f"::error::{display}: pip-audit produced no parseable JSON")
+        if stderr:
+            print(stderr)
+        return 1
+
+    errors = 0
+    findings = extract_findings(data)
+    for package, vuln_id, description in findings:
+        if vuln_id in waivers:
+            print(f"WAIVED: {display}: {package} {vuln_id}")
+        else:
+            print(f"::error::{display}: {package}: {vuln_id} - {description}")
+            errors += 1
+
+    if errors:
+        return errors
+    if findings:
+        print(f"OK: all findings waived for {display}")
+    else:
+        print(f"OK: no vulnerabilities in {display}")
+
+    if code not in (0, 1):
+        print(f"::error::{display}: pip-audit failed with exit code {code}")
+        if stderr:
+            print(stderr)
+        return 1
+    return 0
+
+
 def main() -> int:
     waivers = load_waivers()
     errors = 0
@@ -94,35 +168,23 @@ def main() -> int:
             errors += 1
             continue
 
-        code, data, stderr = run_audit(req)
-        if data is None:
-            print(f"::error::{req}: pip-audit produced no parseable JSON")
-            if stderr:
-                print(stderr)
-            errors += 1
-            continue
+        errors += audit_one(req, waivers)
 
-        findings = extract_findings(data)
-        unwaived = 0
-        for package, vuln_id, description in findings:
-            if vuln_id in waivers:
-                print(f"WAIVED: {req}: {package} {vuln_id}")
-            else:
-                print(f"::error::{req}: {package}: {vuln_id} - {description}")
-                unwaived += 1
-
-        if unwaived:
-            errors += unwaived
-        elif findings:
-            print(f"OK: all findings waived for {req}")
-        else:
-            print(f"OK: no vulnerabilities in {req}")
-
-        if code not in (0, 1):
-            print(f"::error::{req}: pip-audit failed with exit code {code}")
-            if stderr:
-                print(stderr)
+    for req, skipped_packages in NO_DEPS_REQUIREMENT_FILES:
+        print(f"=== pip-audit {req} (no-deps) ===")
+        if not req.exists():
+            print(f"::error::{req} is missing")
             errors += 1
+            continue
+        audit_path = strip_requirement_blocks(req, skipped_packages)
+        if skipped_packages:
+            skipped = ", ".join(sorted(skipped_packages))
+            print(f"NOTE: {req}: skipped non-PyPI local-version package(s): {skipped}")
+        try:
+            errors += audit_one(audit_path, waivers, no_deps=True, label=req)
+        finally:
+            if audit_path != req:
+                audit_path.unlink(missing_ok=True)
 
     if errors:
         print(f"FAIL: {errors} Python dependency audit error(s)")

.github/vuln-waivers.json

@@ -1,20 +1,5 @@
 {
   "_comment": "Vulnerability waivers for CI dependency-audit job. Each entry documents a reviewed finding that is temporarily accepted. Waivers MUST include: id, reason, reviewer, expires (YYYY-MM-DD). Expired waivers are ignored and the finding will fail CI again.",
   "go": [],
-  "python": [
-    {
-      "id": "GHSA-5239-wwwm-4pmq",
-      "package": "pygments",
-      "reason": "ReDoS in AdlLexer — local-only exploit, not reachable from our usage (no archetype syntax highlighting). Awaiting upstream fix.",
-      "reviewer": "sec_ai",
-      "expires": "2026-06-27"
-    },
-    {
-      "id": "GHSA-gc5v-m9x4-r6x2",
-      "package": "requests",
-      "reason": "Predictable temp path in extract_zipped_paths() — we do not call this function. Standard requests usage is not affected per advisory.",
-      "reviewer": "sec_ai",
-      "expires": "2026-06-27"
-    }
-  ]
+  "python": []
 }

.github/workflows/ci.yml

@@ -27,7 +27,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: "1.25.10"
+          go-version: "1.26.3"
           cache-dependency-path: services/${{ matrix.service }}/go.sum
 
       - name: Build
@@ -268,7 +268,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: "1.25.10"
+          go-version: "1.26.3"
 
       - name: Install cosign (signing & attestation)
         run: |
@@ -457,7 +457,7 @@ jobs:
 
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: "1.25.10"
+          go-version: "1.26.3"
 
       - name: Install Python dependencies
         run: pip install -r requirements-ci.txt
@@ -487,7 +487,7 @@ jobs:
 
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: "1.25.10"
+          go-version: "1.26.3"
 
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
@@ -509,7 +509,7 @@ jobs:
 
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: "1.25.10"
+          go-version: "1.26.3"
 
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
@@ -820,7 +820,7 @@ jobs:
 
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: "1.25.10"
+          go-version: "1.26.3"
 
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:

.github/workflows/release.yml

@@ -86,7 +86,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: "1.25.10"
+          go-version: "1.26.3"
           cache-dependency-path: services/${{ matrix.service }}/go.sum
 
       - name: Build (linux/amd64)

build/cpython-patches/0008-cve-2026-6019-cookie-js-output-base64.patch

@@ -0,0 +1,129 @@
+From fe5bddd7ac531140101cdf82aa952c7e3dd6c97d Mon Sep 17 00:00:00 2001
+From: Seth Larson <seth@python.org>
+Date: Wed, 22 Apr 2026 14:22:31 -0500
+Subject: [PATCH] gh-90309: Base64-encode cookie values embedded in JS (cherry
+ picked from commit 76b3923d688c0efc580658476c5f525ec8735104)
+
+Co-authored-by: Seth Larson <seth@python.org>
+---
+ Lib/http/cookies.py                           |  8 +++--
+ Lib/test/test_http_cookies.py                 | 29 ++++++++++++-------
+ ...6-04-21-13-46-30.gh-issue-90309.srvj9q.rst |  3 ++
+ 3 files changed, 27 insertions(+), 13 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Security/2026-04-21-13-46-30.gh-issue-90309.srvj9q.rst
+
+diff --git a/Lib/http/cookies.py b/Lib/http/cookies.py
+index d5b8ba939bee7c..5c5b14788dc2f0 100644
+--- a/Lib/http/cookies.py
++++ b/Lib/http/cookies.py
+@@ -391,17 +391,21 @@ def __repr__(self):
+         return '<%s: %s>' % (self.__class__.__name__, self.OutputString())
+ 
+     def js_output(self, attrs=None):
++        import base64
+         # Print javascript
+         output_string = self.OutputString(attrs)
+         if _has_control_character(output_string):
+             raise CookieError("Control characters are not allowed in cookies")
++        # Base64-encode value to avoid template
++        # injection in cookie values.
++        output_encoded = base64.b64encode(output_string.encode('utf-8')).decode("ascii")
+         return """
+         <script type="text/javascript">
+         <!-- begin hiding
+-        document.cookie = \"%s\";
++        document.cookie = atob(\"%s\");
+         // end hiding -->
+         </script>
+-        """ % (output_string.replace('"', r'\"'))
++        """ % (output_encoded,)
+ 
+     def OutputString(self, attrs=None):
+         # Build up our result
+diff --git a/Lib/test/test_http_cookies.py b/Lib/test/test_http_cookies.py
+index 33da395717deb0..4884b07c95b9c5 100644
+--- a/Lib/test/test_http_cookies.py
++++ b/Lib/test/test_http_cookies.py
+@@ -1,5 +1,5 @@
+ # Simple test suite for http/cookies.py
+-
++import base64
+ import copy
+ import unittest
+ import doctest
+@@ -152,17 +152,19 @@ def test_load(self):
+ 
+         self.assertEqual(C.output(['path']),
+             'Set-Cookie: Customer="WILE_E_COYOTE"; Path=/acme')
+-        self.assertEqual(C.js_output(), r"""
++        cookie_encoded = base64.b64encode(b'Customer="WILE_E_COYOTE"; Path=/acme; Version=1').decode('ascii')
++        self.assertEqual(C.js_output(), fr"""
+         <script type="text/javascript">
+         <!-- begin hiding
+-        document.cookie = "Customer=\"WILE_E_COYOTE\"; Path=/acme; Version=1";
++        document.cookie = atob("{cookie_encoded}");
+         // end hiding -->
+         </script>
+         """)
+-        self.assertEqual(C.js_output(['path']), r"""
++        cookie_encoded = base64.b64encode(b'Customer="WILE_E_COYOTE"; Path=/acme').decode('ascii')
++        self.assertEqual(C.js_output(['path']), fr"""
+         <script type="text/javascript">
+         <!-- begin hiding
+-        document.cookie = "Customer=\"WILE_E_COYOTE\"; Path=/acme";
++        document.cookie = atob("{cookie_encoded}");
+         // end hiding -->
+         </script>
+         """)
+@@ -267,17 +269,19 @@ def test_quoted_meta(self):
+ 
+         self.assertEqual(C.output(['path']),
+                          'Set-Cookie: Customer="WILE_E_COYOTE"; Path=/acme')
+-        self.assertEqual(C.js_output(), r"""
++        expected_encoded_cookie = base64.b64encode(b'Customer=\"WILE_E_COYOTE\"; Path=/acme; Version=1').decode('ascii')
++        self.assertEqual(C.js_output(), fr"""
+         <script type="text/javascript">
+         <!-- begin hiding
+-        document.cookie = "Customer=\"WILE_E_COYOTE\"; Path=/acme; Version=1";
++        document.cookie = atob("{expected_encoded_cookie}");
+         // end hiding -->
+         </script>
+         """)
+-        self.assertEqual(C.js_output(['path']), r"""
++        expected_encoded_cookie = base64.b64encode(b'Customer=\"WILE_E_COYOTE\"; Path=/acme').decode('ascii')
++        self.assertEqual(C.js_output(['path']), fr"""
+         <script type="text/javascript">
+         <!-- begin hiding
+-        document.cookie = "Customer=\"WILE_E_COYOTE\"; Path=/acme";
++        document.cookie = atob("{expected_encoded_cookie}");
+         // end hiding -->
+         </script>
+         """)
+@@ -368,13 +372,16 @@ def test_setter(self):
+             self.assertEqual(
+                 M.output(),
+                 "Set-Cookie: %s=%s; Path=/foo" % (i, "%s_coded_val" % i))
++            expected_encoded_cookie = base64.b64encode(
++                ("%s=%s; Path=/foo" % (i, "%s_coded_val" % i)).encode("ascii")
++            ).decode('ascii')
+             expected_js_output = """
+         <script type="text/javascript">
+         <!-- begin hiding
+-        document.cookie = "%s=%s; Path=/foo";
++        document.cookie = atob("%s");
+         // end hiding -->
+         </script>
+-        """ % (i, "%s_coded_val" % i)
++        """ % (expected_encoded_cookie,)
+             self.assertEqual(M.js_output(), expected_js_output)
+         for i in ["foo bar", "foo@bar"]:
+             # Try some illegal characters
+diff --git a/Misc/NEWS.d/next/Security/2026-04-21-13-46-30.gh-issue-90309.srvj9q.rst b/Misc/NEWS.d/next/Security/2026-04-21-13-46-30.gh-issue-90309.srvj9q.rst
+new file mode 100644
+index 00000000000000..d7d376737e4ad1
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2026-04-21-13-46-30.gh-issue-90309.srvj9q.rst
+@@ -0,0 +1,3 @@
++Base64-encode values when embedding cookies to JavaScript using the
++:meth:`http.cookies.BaseCookie.js_output` method to avoid injection
++and escaping.