security(deps): isolate ragas/diskcache no-patch alerts + audit doc (#2043)#2072
Closed
yastman wants to merge 1 commit into
Closed
security(deps): isolate ragas/diskcache no-patch alerts + audit doc (#2043)#2072yastman wants to merge 1 commit into
yastman wants to merge 1 commit into
Conversation
…2043) Two open Dependabot alerts have no upstream patched version: - diskcache CVE-2025-69872 (medium), <=5.6.3, no patch - ragas CVE-2026-6587 (low), >=0.2.3, <=0.4.3, no patch Repository exposure analysis on dev: ragas: declared ONLY in [project.optional-dependencies].eval. Imported ONLY in src/evaluation/ragas_evaluation.py (RAGAS metrics for the evaluation pipeline). Reached only by 'make eval-rag*' targets. The bot/API/Mini-App/voice runtimes do not import src.evaluation.* and do not install the eval extra. diskcache: not declared in any pyproject.toml. Pulled into uv.lock transitively by ragas. No first-party import in src/, telegram_bot/, mini_app/, services/, scripts/, or tests/. Same install gate as ragas (eval extra). Audit decision: keep both transitive-isolated, do not blanket-dismiss the alerts, and lock the seam with a contract test that fails if either package leaks back into production deps or first-party imports. Adds: - docs/security/dependabot-no-patch-audit-2026-05-22.md — explicit risk acceptance with verification commands and upstream tracking note. - tests/contract/test_dependabot_no_patch_isolation_contract.py — six invariants: 1. ragas not in [project].dependencies. 2. ragas appears in exactly one optional extra ('eval'). 3. ragas absent from telegram_bot/mini_app/services pyprojects. 4. diskcache not declared as a direct dep anywhere. 5. diskcache not imported in first-party code. 6. ragas imports confined to src/evaluation/. Verification: uv run pytest tests/contract/test_dependabot_no_patch_isolation_contract.py -q 6 passed uv run pytest tests/contract/test_*_contract.py -q (subset) 70 passed uv run python scripts/check_markdown_links.py All relative Markdown links OK. uvx ruff check tests/contract/test_dependabot_no_patch_isolation_contract.py All checks passed! Closes #2043
This was referenced May 22, 2026
Owner
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request was created by @kiro-agent on behalf of @yastman 👻
Comment with /kiro fix to address specific feedback or /kiro all to address everything.
Learn about Kiro autonomous agent
Summary
Two open Dependabot alerts have no upstream patched version:
diskcache<=5.6.3ragas>=0.2.3, <=0.4.3This PR documents the audit decision (monitor-and-isolate, not "patch-or-replace") and locks the isolation with a contract test.
Audit findings
ragasis declared only in[project.optional-dependencies].eval. Imported only insrc/evaluation/ragas_evaluation.py(the RAGAS metric pipeline). Reached only bymake eval-rag*targets. The bot, API, Mini App, voice, and ingestion runtimes do not importsrc.evaluation.*and do not install theevalextra.diskcacheis not declared anywhere in this repo. It lands inuv.lockonly as a transitive dependency ofragas, so the same install gate applies.Changes
docs/security/dependabot-no-patch-audit-2026-05-22.md— explicit risk acceptance with verification commands and upstream-tracking notes.tests/contract/test_dependabot_no_patch_isolation_contract.py— 6 invariants that fail loudly if either package leaks into production deps or first-party imports.Verification
Closes #2043