fix(security): serialize Mojo shared-memory payloads as JSON, not pickle

[groupthinking]

Replaces pickle.dumps(message) with JSON in MojoTransportLayer._shared_memory_send and drops the pickle import — the last pickle serialization in production code. Pickle bytes in a cross-process shared-memory segment force any receiver into pickle.loads, the same RCE pattern REM-001 already removed from the Redis cache. Both message layers expose to_dict(), so the payload is now a JSON object of the A2A message, MCP context, and transport hints.

Context: the issue's attached plan is largely stale — SEC-001 (cache pickle), SEC-002 (npm vulns), and SEC-003 (dangerouslySetInnerHTML in the removed frontend/) are already resolved per docs/analysis/REMEDIATION_PLAN.md (re-verified 2026-08-04), and src/vera/ no longer exists. This residual pickle usage was the remaining code-actionable finding.

Note: the session ended before tests could be run against this change; please verify tests/unit/test_security_fixes.py in CI.

[linear-code]

GRV-423

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
v0-uvai	Canceled	v0	Aug 30, 2026 11:11pm

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 042989a.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

None