Fix HIGH CVEs: certifi, click, pyasn1, starlette

Patches the following vulnerabilities flagged in the KRR-Production-Legacy scan:

- CVE-2024-39689 (certifi 2024.2.2): pin certifi >=2024.7.4 in pyproject,
  locked to 2026.7.22 (removes GLOBALTRUST root certificates).
- CVE-2026-7246 (click 8.1.7): pin click ^8.3.3 in pyproject, locked to
  8.5.0 (command injection in click.edit()).
- CVE-2026-30922 / CVE-2026-59884 / CVE-2026-59885 / CVE-2026-59886
  (pyasn1): main app already locked to 0.6.4 (fixed); raise the enforcer
  floor from >=0.6.2 to >=0.6.4 so image builds cannot resolve a
  vulnerable version.
- CVE-2026-48818 / CVE-2026-54283 (starlette): raise the enforcer floor
  from >=1.0.0 to >=1.3.1 (StaticFiles UNC SSRF fixed in 1.1.0, form
  limit bypass DoS fixed in 1.3.1). fastapi 0.139.0 allows
  starlette >=0.46.0 with no upper bound, so this resolves cleanly.

Compatibility changes required by click >=8.2:

- Bump typer ^0.7.0 -> ^0.19.2 (typer 0.7 crashes on import-time option
  validation with click >=8.2; rich stays at 12.6.0).
- Normalize unspecified list CLI options from None to [] in
  load_commands() - newer typer passes None instead of an empty tuple,
  which crashed the "*" membership checks and config validators.
- Accept None in the prometheus_other_headers validator.
- Drop the removed mix_stderr argument from CliRunner in tests (stderr
  is captured separately by default in click >=8.2).

All 55 tests pass; krr --help / simple --help verified working.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017tvW9dxfAQAMKE8EJHQT7E

Author: claude

enforcer/requirements.txt

@@ -1,12 +1,12 @@
 fastapi==0.139.0
 uvicorn==0.27.1
 pydantic==2.13.4
-starlette>=1.0.0
+starlette>=1.3.1
 supabase==2.5
 PyYAML==6.0.1
 cachetools==5.3.3
 prometheus-client==0.20.0
 python-json-logger==3.3.0
 kubernetes==26.1.0
-pyasn1>=0.6.2
+pyasn1>=0.6.4
 urllib3==2.7.0

poetry.lock

@@ -24,7 +24,8 @@ krr = "robusta_krr.main:run"
 
 [tool.poetry.dependencies]
 python = ">=3.10,<=3.12.9"
-typer = { extras = ["all"], version = "^0.7.0" }
+# typer >=0.16 is needed for compatibility with click >=8.2 (click pinned below for CVE-2026-7246)
+typer = "^0.19.2"
 pydantic = "^1.10.7"
 kubernetes = "^26.1.0"
 prometheus-api-client = "0.5.3"
@@ -43,6 +44,8 @@ setuptools = "^83.0.0"
 # transitive deps pinned for CVE fixes
 pillow = "^12.3.0"
 pyasn1 = "^0.6.4"
+certifi = ">=2024.7.4"
+click = "^8.3.3"
 zipp = "^3.19.1"
 tenacity = "^9.0.0"
 python-json-logger = "^3.0.0"

pyproject.toml

@@ -3,9 +3,9 @@ alive-progress==3.1.5 ; python_version >= "3.10" and python_full_version < "3.13
 boto3==1.42.19 ; python_version >= "3.10" and python_full_version < "3.13"
 botocore==1.42.19 ; python_version >= "3.10" and python_full_version < "3.13"
 cachetools==5.3.3 ; python_version >= "3.10" and python_full_version < "3.13"
-certifi==2024.2.2 ; python_version >= "3.10" and python_full_version < "3.13"
+certifi==2026.7.22 ; python_version >= "3.10" and python_full_version < "3.13"
 charset-normalizer==3.3.2 ; python_version >= "3.10" and python_full_version < "3.13"
-click==8.1.7 ; python_version >= "3.10" and python_full_version < "3.13"
+click==8.5.0 ; python_version >= "3.10" and python_full_version < "3.13"
 colorama==0.4.6 ; python_version >= "3.10" and python_full_version < "3.13"
 commonmark==0.9.1 ; python_version >= "3.10" and python_full_version < "3.13"
 contourpy==1.2.0 ; python_version >= "3.10" and python_full_version < "3.13"
@@ -47,7 +47,7 @@ shellingham==1.5.4 ; python_version >= "3.10" and python_full_version < "3.13"
 six==1.16.0 ; python_version >= "3.10" and python_full_version < "3.13"
 slack-sdk==3.27.1 ; python_version >= "3.10" and python_full_version < "3.13"
 tenacity==9.0.0 ; python_version >= "3.10" and python_full_version < "3.13"
-typer==0.7.0 ; python_version >= "3.10" and python_full_version < "3.13"
+typer==0.19.2 ; python_version >= "3.10" and python_full_version < "3.13"
 typing-extensions==4.16.0 ; python_version >= "3.10" and python_full_version < "3.13"
 tzdata==2024.1 ; python_version >= "3.10" and python_full_version < "3.13"
 tzlocal==5.2 ; python_version >= "3.10" and python_full_version < "3.13"

requirements.txt

@@ -119,7 +119,10 @@ def validate_prometheus_url(cls, v: Optional[str]):
         return v
 
     @pd.validator("prometheus_other_headers", pre=True)
-    def validate_prometheus_other_headers(cls, headers: Union[list[str], dict[str, str]]) -> dict[str, str]:
+    def validate_prometheus_other_headers(cls, headers: Union[list[str], dict[str, str], None]) -> dict[str, str]:
+        if headers is None:
+            return {}
+
         if isinstance(headers, dict):
             return headers
 

robusta_krr/core/models/config.py

@@ -353,6 +353,12 @@ def run_strategy(
                 **strategy_args,
             ) -> None:
                 f"""Run KRR using the `{_strategy_name}` strategy"""
+                # typer >= 0.12 passes None (instead of an empty tuple) for unspecified list options
+                clusters = clusters or []
+                namespaces = namespaces or []
+                resources = resources or []
+                prometheus_other_headers = prometheus_other_headers or []
+                named_sinks = named_sinks or []
                 if not show_severity and format != "csv":
                     raise click.BadOptionUsage("--exclude-severity", "--exclude-severity works only with format=csv")
 

robusta_krr/main.py

@@ -7,7 +7,8 @@
 from robusta_krr.core.integrations.kubernetes import ClusterLoader
 from robusta_krr.core.models.config import settings
 
-runner = CliRunner(mix_stderr=False)
+# click >= 8.2 removed mix_stderr; stderr is now always captured separately
+runner = CliRunner()
 load_commands()
 
 STRATEGY_NAME = "simple"

tests/test_krr.py

@@ -4,7 +4,8 @@
 
 from robusta_krr.main import app, load_commands
 
-runner = CliRunner(mix_stderr=False)
+# click >= 8.2 removed mix_stderr; stderr is now always captured separately
+runner = CliRunner()
 load_commands()