From 211938f238e376ec2b36c7d93aca6cdf64db3028 Mon Sep 17 00:00:00 2001 From: kkdev92 Date: Mon, 17 Aug 2026 23:05:10 +0900 Subject: [PATCH] Record why the starlette advisories are pinned open Pinning CI's Python tools by hash made the resolved dependency set visible to Scorecard's vulnerability scanner for the first time, and it reports five published advisories against starlette 0.52.1, which PlatformIO pulls in. They are left open in code scanning rather than dismissed, because they are real. What was missing was the reason they are still here, written down where someone looking at the pin will find it. All five are flaws in serving HTTP: Host header validation, request path handling, StaticFiles traversal, and form field limits. PlatformIO lists starlette under "PIO Home requirements" and imports it only in platformio/home/run.py, the web UI behind `pio home`. CI runs pio test, pio run and pio check, none of which start that server; the only other reference, in platformio/compat.py, sits on the Python < 3.9 branch that 3.12 never takes. There is also nowhere to move to. Every fixed version is 1.3.1 or earlier but above 0.53, and PlatformIO 6.1.19 -- the current release -- requires starlette >=0.19,<0.53. The exit condition is PlatformIO widening that constraint, after which regenerating the lock closes the alert. The generated lock is byte-identical after this change; comments in the .in file do not reach it. Co-Authored-By: Claude Opus 5 (1M context) --- tools/requirements-ci.in | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/tools/requirements-ci.in b/tools/requirements-ci.in index 43037e4..d7d2a1e 100644 --- a/tools/requirements-ci.in +++ b/tools/requirements-ci.in @@ -15,3 +15,23 @@ platformio==6.1.19 gcovr==8.6 + +# Known advisories in the resolved set, and why they are still here. +# +# starlette is pulled in by PlatformIO and currently resolves to 0.52.1, which +# carries five published advisories: PYSEC-2026-161, -248, -249, -2280 and +# -2281. All five are flaws in serving HTTP -- Host header validation, request +# path handling, StaticFiles traversal, and form field limits -- and all are +# fixed in starlette 1.3.1 or earlier. +# +# They are not reachable here. PlatformIO lists starlette under "PIO Home +# requirements" and imports it only in platformio/home/run.py, the local web UI +# behind `pio home`. CI runs pio test, pio run and pio check, none of which +# start that server; the one other reference, in platformio/compat.py, is a +# threadpool shim on the Python < 3.9 branch that 3.12 never takes. +# +# There is no version to move to. PlatformIO 6.1.19 is the current release and +# requires starlette >=0.19,<0.53, so every fixed version is outside the range +# it will accept. The advisories are left visible in code scanning rather than +# dismissed, and close on their own once PlatformIO widens that constraint and +# this lock is regenerated.