fix(deps): remediate High Vanta vulns for POT-2264 (stale legacy/uv.lock SBOM)

[shmbhvi101]

Vulnerability details

Linear: POT-2264

#	Package	Vulnerable range	Fixed / status	Advisory
1	cryptography (pip)	>=44.0.0, <50.0.0	Workspace locks already 50.0.0 (#1042/#1045); this PR replaces stale legacy/uv.lock SBOM that still listed 49.0.0	CVE-2026-69247 / dependabot/377
2	aiohttp (pip)	<=3.14.2	Workspace locks already 3.14.3 (#1038/#1045); this PR clears ghost 3.14.1 via empty legacy/uv.lock	CVE-2026-69244 / dependabot/376
3	GitPython (pip)	<=3.1.56	Floor already >=3.1.58 (#1045); ghost 3.1.54 cleared by empty lock	dependabot/371
4–8	GitPython (pip)	<=3.1.57	Same — floor >=3.1.58; empty lock removes ghost pin	dependabot/380–385

Why this PR

#1045 / #1042 already raised workspace floors (cryptography>=50.0.0, aiohttp>=3.14.3, gitpython>=3.1.58). #1046 added an empty legacy/pyproject.toml stub for Medium findings. GitHub’s dependency graph still listed a ghost legacy/uv.lock (file deleted in #1034) whose SBOM resolved aiohttp==3.14.1, cryptography==49.0.0, and gitpython==3.1.54 under potpie-legacy@0.1.0, so these High Vanta findings stayed open.

Fix summary

• Add empty legacy/uv.lock (only potpie-legacy itself; no third-party deps) at the same path as the ghost lock so Dependabot can replace the stale snapshot.
• Bump hygiene stub potpie-legacy 0.1.0 → 0.1.1 and refresh README/comments for POT-2264 High advisories.
• Confirm root override floor comment covers Dependabot added graceful error handling in auth_router and auth_service #380–fix: Improved Error handling for api_key_service #385.

Validation

• legacy/uv.lock: only potpie-legacy==0.1.1 (no aiohttp / cryptography / gitpython)
• Workspace locks unchanged and still patched: aiohttp==3.14.3, cryptography==50.0.0, gitpython floor >=3.1.58
• uv lock --check passes on root
• OSV: aiohttp@3.14.3, cryptography@50.0.0, GitPython@3.1.58 → 0 vulns

Review

Please review: @yashkrishan
(Automated review request via GitHub API may return 403 for this integration token.)

Do not mark Linear Done — Vanta poller closes when findings clear.

Linear note

Linear MCP auth is unavailable in this cloud agent environment (needsAuth; interactive auth not available). Please authenticate Linear MCP / add LINEAR_API_KEY, move POT-2264 to In Progress, and comment with this PR URL.

Linear Issue: POT-2264

  

[linear-code]

POT-2264

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 51d15151-6808-4995-b090-7ccc0a4a4145

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}