Dependency security audit — 2026-10-29¶

This audit covers the 51 open Dependabot alerts captured on 2026-10-29 for Sandloom at 30cd55f. The snapshot contains 8 critical, 26 high and 17 medium alerts: 41 Pillow, 7 Authlib, 2 certifi and 1 virtualenv. The certifi advisory occurs in two manifests; alert count is not a count of distinct vulnerabilities or confirmed exploitable Sandloom paths. Severity and affected ranges below preserve that snapshot; upstream advisory records can change.

Remediation targets¶

The callgrind harness export belongs to Sandloom's benchmark environment. Its Pillow/Authlib pins had drifted from benchmarks/uv.lock, which already selected Pillow 13.0.0 and Authlib 1.9.1. Regenerate the export from the corrected benchmark lock rather than maintain another independent version list.

The main lock already selected Pillow 13.0.0, Authlib 1.9.1 and certifi 2026.10.19. The identity distribution already required pillow>=13.0.0,<14, so no additional core Pillow upgrade is needed. Its authlib>=1.8.0,<2 requirement still permitted vulnerable fresh resolutions and needs a >=1.9.1,<2 floor. Core already requires certifi>=2026.10.19. These are findings from the committed identity metadata, core metadata, main lock and benchmark lock.

Select certifi 2026.10.19 rather than stop at the first patched release: 2026.10.18 removed all emSign roots, while 2026.10.19 restored unaffected roots. The reviewed advisory recommends 2026.10.19 or later and rebuilding images that vendor the bundle.

Compatibility review¶

Official release metadata declares Python >=3.11 for Pillow 13.0.0, >=3.10 for Authlib 1.9.1, >=3.7 for certifi 2026.10.19, and >=3.9 for virtualenv 21.14.13. All fit Sandloom's Python >=3.11 and the benchmark environment's >=3.12. This checks interpreter eligibility, not runtime compatibility by itself.

• Pillow: version 13 drops Python 3.10 and removes direct I-mode PNG saving and fromarray(mode=...) dtype conversion. The reviewed Sandloom QR utility and 2FA service generate a QR image through qrcode and save PNG; neither directly calls those removed APIs. Keep QR generation in compatibility checks. Pillow release notes
• Authlib: 1.9.1 rejects empty HMAC keys and requires joserfc>=1.6.8. The 1.9 series also tightens nonce validation, JAR URI retrieval and JWT bearer audiences; RFC 7592 token implementations need check_client(). Review any application-provided integration that relies on those behaviors; do not weaken the new validation to recover compatibility. Authlib changelog
• virtualenv: 21.14.13 fixes generated shell activator prompt escaping. It is development tooling through pre-commit in the main lock, not a Sandloom request handler. Verify the locked tool environment as well as the application tests. virtualenv release history

The Authlib empty-HMAC upstream report still contains older affected-version text; the reviewed advisory's structured fields and the official 1.9.1 changelog agree on the patched release. The ledger uses those patched-version fields rather than the stale narrative.

Complete alert ledger¶

Every captured alert is listed once. Ranges and minimum fixes come from the Dependabot snapshot's security_vulnerability fields; each GHSA links to its public advisory. Package names are case-normalized for grouping.

Pillow — 41 alerts¶

Manifest: benchmarks/ladder/cg/requirements.txt. Selected version: 13.0.0.

Authlib — 7 alerts¶

Manifest: benchmarks/ladder/cg/requirements.txt. Selected version: 1.9.1.

certifi and virtualenv — 3 alerts¶

Selected versions: certifi 2026.10.19; virtualenv at least 21.14.13.

Verification and reproducibility boundaries¶

The remediation was checked with frozen-lock installs, all 51 captured affected version ranges, export parity and a negative control using the stale export. pip-audit 2.10.1 found no known vulnerabilities in the exported contributor environment (136 packages) or benchmark environment (94 packages).

Validation passed: 5055 backend tests, 1229 architecture tests, three typing tests, 560 benchmark security/correctness tests and 11 load-harness negative controls, with the suites' documented skips and expected failure. All four distributions built and installed in clean environments; the identity wheel enforces authlib>=1.9.1,<2. A rebuilt Linux/Python 3.13 Cachegrind image imports all benchmark apps, matches the shared dependency versions and generates a real identity QR/PNG. The virtualenv prompt advisory reproduces with a harmless temporary marker on 21.14.12 and stays inert on 21.14.13.

The complete backend run uses Python 3.12; interpreter eligibility above is not a claim that this change reran the entire Python-version matrix. Normal isolation and release gates remain intact.

Hosted verification exposed a false rejection in the load-client precision test: its requirement for 100 distinct rounded-microsecond values confused latency variance with clock resolution. The test now checks fractional milliseconds independently of that variance, keeps coarse-clock negative controls, and verifies the actual closed-loop client with a controlled perf_counter. Runtime latency measurement is unchanged. A passing version-range check covers this snapshot; it does not establish the absence of every future advisory or every application configuration risk.

A corrected Git branch does not modify published PyPI wheels or users' existing environments. Updated dependency floors take effect for consumers with a new package release; current installations must refresh their environment and any vendored/container CA bundle. GitHub alert closure must be checked after the fix reaches the default branch and Dependabot re-evaluates it.

Retain historical benchmark result artifacts and their recorded environments. The repaired benchmark lock/export is the input to future runs; it does not retroactively change past measurements. This audit runs no paid agent DX benchmark and makes no new performance claim.

The source evidence was the 51-entry GitHub Dependabot API snapshot captured on 2026-10-29, SHA-256 8560b3c052e3bb4563af27e58608c1fd8ab2b67cd9e51b962c9daaad40ff544c. The complete ledger above preserves its alert-to-manifest and version mapping without relying on access to the maintainer's security dashboard.

Related reading¶

• Supply-chain checks
• CI profiles and required checks
• Publishing packages
• Versioning policy