Running backlog from the daily security sweep. Items here are not blocking PRs — they are things the sweep found and could not safely fix inside a security-only bundle.
2026-09-02 — python-api unit tests are broken on main (pre-existing)
Found while establishing a verification baseline for #2.
Repo: vectorize-iris · Path: python-api · Step: uv run pytest
Result on unmodified main (no dependency changes at all):
10 failed, 9 passed, 10 skipped
Exact signature:
E AttributeError: module 'vectorize_iris' has no attribute 'requests'
.../unittest/mock.py:1451: in __enter__
self.target = self.getter()
.../pkgutil.py:528: in resolve_name
result = getattr(result, p)
Failing tests:
tests/test_async_client.py::TestExtractTextAsync::test_file_not_found
tests/test_async_client.py::TestExtractTextAsync::test_successful_extraction
tests/test_async_client.py::TestExtractTextAsync::test_extraction_failure
tests/test_vectorize_iris.py::TestExtractText::test_file_not_found
tests/test_vectorize_iris.py::TestExtractText::test_successful_extraction
tests/test_vectorize_iris.py::TestExtractText::test_upload_failure
tests/test_vectorize_iris.py::TestExtractText::test_file_upload_failure
tests/test_vectorize_iris.py::TestExtractText::test_extraction_failure
tests/test_vectorize_iris.py::TestExtractText::test_extraction_timeout
tests/test_vectorize_iris.py::TestExtractText::test_custom_credentials
Cause: the tests mock.patch("vectorize_iris.requests…"), but the package never re-exports requests / aiohttp at top level, so mock cannot resolve the target. This is a test-authoring issue, not a dependency issue — the patch targets should be the module that actually imports them (e.g. vectorize_iris.client.requests, vectorize_iris.async_client.aiohttp).
Why it went unnoticed: .github/workflows/ci.yml job test-python is named "Test Python API" but only runs:
- name: Build Python package
run: |
cd python-api
python -m buildIt never invokes pytest. Worth adding uv sync && uv run pytest to that job once the suite is green, otherwise this rots again.
Deliberately not fixed in #2 to keep that bundle a pure security change.
2026-09-02 — fallback if requires-python >= 3.10 is rejected in #2
Every fix version for the flagged packages needs Python >= 3.10, so #2 raises requires-python. If maintainers must keep 3.8/3.9 support, the fallback is a lock-only scoped upgrade, which leaves these 59 GHSA occurrences unfixed on the legacy fork branches:
| pin (legacy fork) |
remaining GHSA |
aiohttp==3.10.11 |
33 |
aiohttp==3.13.5 |
14 |
urllib3==2.2.3 |
6 |
urllib3==2.6.3 |
2 (incl. GHSA-mf9v-mfxr-j63j) |
pytest==8.3.5 / 8.4.2 |
1 each |
requests==2.32.4 / 2.32.5 |
1 each |
2026-09-02 — Dependabot alerts are not scanning this repo
/repos/vectorize-io/vectorize-iris/dependabot/alerts returns HTTP 200 with an empty array for all four states (open, fixed, dismissed, auto_dismissed) — never a single alert recorded, despite python-api/uv.lock carrying 43 real advisories. That is "enabled endpoint, never scanned", not "clean".
Recommend enabling Dependabot alerts under Settings → Code security. Until then this repo can only be swept via local OSV/pip-audit runs, and dedupe has to key on GHSA ids and branch names rather than alert numbers.
Also note nodejs-api/ and rust-cli/ ship no committed lockfile (package-lock.json / Cargo.lock), so neither Dependabot nor a local audit can pin down their dependency versions. CI runs a bare npm install for nodejs-api. Committing lockfiles would make both auditable.
Running backlog from the daily security sweep. Items here are not blocking PRs — they are things the sweep found and could not safely fix inside a security-only bundle.
2026-09-02 —
python-apiunit tests are broken onmain(pre-existing)Found while establishing a verification baseline for #2.
Repo: vectorize-iris · Path:
python-api· Step:uv run pytestResult on unmodified
main(no dependency changes at all):Exact signature:
Failing tests:
Cause: the tests
mock.patch("vectorize_iris.requests…"), but the package never re-exportsrequests/aiohttpat top level, somockcannot resolve the target. This is a test-authoring issue, not a dependency issue — the patch targets should be the module that actually imports them (e.g.vectorize_iris.client.requests,vectorize_iris.async_client.aiohttp).Why it went unnoticed:
.github/workflows/ci.ymljobtest-pythonis named "Test Python API" but only runs:It never invokes pytest. Worth adding
uv sync && uv run pytestto that job once the suite is green, otherwise this rots again.Deliberately not fixed in #2 to keep that bundle a pure security change.
2026-09-02 — fallback if
requires-python >= 3.10is rejected in #2Every fix version for the flagged packages needs Python >= 3.10, so #2 raises
requires-python. If maintainers must keep 3.8/3.9 support, the fallback is a lock-only scoped upgrade, which leaves these 59 GHSA occurrences unfixed on the legacy fork branches:aiohttp==3.10.11aiohttp==3.13.5urllib3==2.2.3urllib3==2.6.3GHSA-mf9v-mfxr-j63j)pytest==8.3.5/8.4.2requests==2.32.4/2.32.52026-09-02 — Dependabot alerts are not scanning this repo
/repos/vectorize-io/vectorize-iris/dependabot/alertsreturns HTTP200with an empty array for all four states (open,fixed,dismissed,auto_dismissed) — never a single alert recorded, despitepython-api/uv.lockcarrying 43 real advisories. That is "enabled endpoint, never scanned", not "clean".Recommend enabling Dependabot alerts under Settings → Code security. Until then this repo can only be swept via local OSV/pip-audit runs, and dedupe has to key on GHSA ids and branch names rather than alert numbers.
Also note
nodejs-api/andrust-cli/ship no committed lockfile (package-lock.json/Cargo.lock), so neither Dependabot nor a local audit can pin down their dependency versions. CI runs a barenpm installfornodejs-api. Committing lockfiles would make both auditable.