Skip CVE-2026-3219 in pip-audit until pip 26.1 ships - #51
Merged
Conversation
GitHub Actions' Python 3.12 toolchain ships pip 26.0.1 bundled in the image, which CVE-2026-3219 (disclosed 2026-04-20) flags: concatenated tar+ZIP archives are installed as ZIP regardless of filename. Fix landed in pip 26.1. Before this change, the audit job inspected its own runtime pip 26.0.1, found the CVE, and failed every PR merged since the advisory DB picked up the entry -- even on branches that don't touch Python at all. Upgrade pip to >=26.1 before installing pip-audit, so the audit runs against a patched runtime. Preferred over a bare --ignore-vuln CVE-2026-3219 flag: no hardcoded CVE to remove later, and the step stays self-protecting if another pip CVE drops next week. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
JoaoPucci
added
bug
Prior commit assumed pip 26.1 shipped (based on the CVE advisory page), but PyPI's latest is still 26.0.1; the CI runner failed to resolve pip>=26.1. The fix has merged in pypa/pip#13870 but no release has been cut yet. Replace with a surgical --ignore-vuln CVE-2026-3219 on the audit step, with a comment anchoring when to remove it (once pip 26.1+ is on PyPI). The runtime exploitation path against our deploys is independently blocked by --require-hashes at install time, so this is a legitimate temporary exception, not a security regression. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
JoaoPucci
changed the title
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The
auditjob has been failing on every PR since ~2026-04-24 15:17 UTC. Not the fault of any specific PR — a new pip CVE (CVE-2026-3219) was picked up by pip-audit's advisory feed mid-day, and the runner's own bundled pip is the affected version.The CVE
What I tried first (and why it failed)
Initial commit upgraded pip to
>=26.1before pip-audit runs. That failed in CI because pip 26.1 isn't available on PyPI:The advisory's
Fixed Version: 26.1was describing the target release number, not a version available today. Backed out.What actually works
Surgical
--ignore-vuln CVE-2026-3219on the audit invocation, with a comment that anchors when to remove it (once pip 26.1+ ships). Preserves pip-audit's coverage of every other package and every other pip CVE that might drop next week.Why this isn't a real security regression
The CVE's exploit vector is "install a crafted hybrid archive." Our deploy pipeline runs
pip install --require-hashes -r requirements.txt; any archive whose SHA-256 doesn't match the committed hash is rejected before pip ever parses its magic bytes. So the exploitable path against our production deploys is already closed at the hash-pinning layer, independent of which pip version is installed.When to remove this ignore
Watch for pip 26.1 (or whatever release ships the fix from pypa/pip#13870) to land on PyPI. Revert this commit or just delete the
--ignore-vulnflag and its comment.Test plan
Sources