docs: re-verify CVE-2025-15367 (poplib) acceptance against v3.14.7 - #199
Merged
Conversation
Issue #52's source-verification table named v3.14.6 as the pinned runtime, which went stale when the runtime moved to 3.14.7 in PR #195. Re-verified independently at the source (Lib/poplib.py at v3.14.7 vs main): the POP3._putcmd() control-character guard is still absent from v3.14.7 and present only on main. No backport has appeared on gh-143923 since 2026-07-26. The acceptance is unchanged. - ci/grype.yaml: Group B block now cites v3.14.7 and records the 2026-08-11 re-check. - #52: verification table, date, and its cross-references to the now closed #98/#116 updated to point at their current tracking location (ci/grype.yaml + docs/ARCHIVE.md §14) instead of the closed issues. - docs/ARCHIVE.md §14: dated entry recording the re-verification method, result, and cross-reference retargeting. Not changed: the waiver itself, #52's review date/cadence, the Group A-1/A-2 blocks and their review date, or anything scoping a 3.15 move. See docs/ARCHIVE.md §14 (2026-08-11) for the full record.
tyler-rich
added a commit
that referenced
this pull request
Aug 11, 2026
) - .claude/settings.json: add includeGitInstructions: false. Attribution block is untouched. Motivated by #199, where the attribution keys were confirmed live but the PR-creation path still appended a footer while a direct issue-body edit in the same session came back clean — the append is specific to the built-in PR workflow instructions this setting controls, not attribution.pr. Second attempt at the same problem, not a replacement for the attribution block. - CLAUDE.md: add a standing rule that a PR body describes the change, not the session's own process — no authorship-check narration, footer-status commentary, merge-permission statements, or scope/stop-condition meta-commentary. That content belongs in the session's chat summary instead. See docs/ARCHIVE.md §14 (2026-08-11) for the full record, including the accepted tradeoff (CLAUDE.md becomes the sole source of git conventions for sessions running with this setting) and confirmation that the settings file still validates against the published schema. Not changed: the never-PATCH rule, the attribution block, #199's branch, or CONTRIBUTING.md.
tyler-rich
added a commit
that referenced
this pull request
Aug 11, 2026
…-attempt cap (#202) * docs: delete .claude/settings.json; reinstate footer strip with a one-attempt cap The committed project-scope settings file is removed in full — both the attribution block from #197 and includeGitInstructions from #200. Three sequential settings-layer attempts did not stop the attribution footer: #197 added the attribution keys, #200 added includeGitInstructions after #199 still showed a footer, and #201 ran with both merged and live and still got one on its PR body. The approach is abandoned, not paused. With no settings-level backstop left, the strip instruction returns to CLAUDE.md § Attribution and CONTRIBUTING.md § Pull request process — but capped at one PATCH per body, with a hard stop if the footer comes back. The cap prices #197's evidence rather than disputing it: each PATCH runs under a bot identity and leaves a permanent "claude (Bot)" entry in GitHub's public edit history, and #196 showed a second attempt only doubles that cost without changing the outcome. Commit-authorship verification is unchanged. The .gitignore comment that explained why the settings file was tracked is rewritten, and docs/ARCHIVE.md §14 records the deletion, the cap, and the fact that this is the fourth reversal of this policy. * docs(archive): record the strip's first outcome on #202's own body The §14 entry documented the policy change but not its result, since it was written before the PR was opened. Adds the outcome: the strip held on this PR's own body — footer found on creation, one PATCH, clean confirming re-read — which is the first success in this project's history. Bounds it on both sides rather than claiming more than it shows. The footer appeared on creation with #197's and #200's keys live and merged, the same result #201 got, so the settings demonstrably did not stop the append; whatever they may have contributed is confined to the re-append after the PATCH, and that is now an open and unfalsifiable question since the file is gone. The next PR is the harder test, running with no settings file at all. Also notes that #196's failures were on an issue comment while this success was on a PR body, so it does not refute #196.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Re-verification and record update for #52 (CVE-2025-15367,
poplib— standing acceptance on any interpreter below 3.15). Not a change of decision. The acceptance stands unchanged.#52's source-verification table was dated 2026-07-26 and named
v3.14.6as "the pinned runtime." PR #195 moved the runtime to 3.14.7 the same day, so that row named a version the project no longer runs — the exact staleness this repo's issue convention (source-verification evidence must cover exactly the state it claims to cover) exists to prevent. Separately, PR #196 closed #98 and #116 and moved Group A tracking intoci/grype.yaml+docs/ARCHIVE.md§14; #52 still cross-referenced #98 as a live tracker.Verification performed
Per CLAUDE.md § Dependency hygiene — verified at the source, not from Grype's
FIXED INcolumn, the advisory's "fixed in" field, #52's existing table, or #195's archive entry:Lib/poplib.pyfrom thev3.14.7tag and frommain(shallow clone).POP3._putcmd()'s control-character guard (re.search(b'[\x00-\x1F\x7F]', line)) is present onmain, absent fromv3.14.7— unchanged from the 2026-07-26 finding.mainfix) carried backport labels for 3.10–3.14 before merge; all were removed prior to merging on 2026-01-20 over a stated backward-compatibility concern.grep -r poplib backend/returns no matches. This covers Scrye's own code only, not a claim that no bundled third-party dependency ever imports it.None of the stop conditions in the task fired: the guard is not present at 3.14.7, no backport has appeared on any maintenance branch.
Changes
ci/grype.yaml— Group B block now citesv3.14.7(notv3.14.6) as the pinned runtime, records the 2026-08-11 re-check and the PR #143924 backport-label detail, and the block-index row gains the 2026-08-11 date.v3.14.7; the "Group A tracker" section and the closingRef:line retarget from the closed Group A CPython interpreter CVEs on 3.14 — accepted risk until the next 3.14.x point release #98/Group A tarfile CVEs on 3.14 (CVE-2026-11940 / -11972 / -0864) — accepted risk until the next 3.14.x point release #116 to their current tracking location (ci/grype.yaml+docs/ARCHIVE.md§14), kept only as historical links. Structure and argument preserved — not rewritten.docs/ARCHIVE.md§14 — new dated entry recording the re-verification method, result, and cross-reference retargeting; index count updated 162 → 163.Explicitly not changed
The CVE-2025-15367 waiver itself; #52's review date or annual cadence (still 2027-07-25); the Group A-1/A-2 waiver blocks and their 2026-11-01 review date (settled in #196); any scoping/costing/argument for a 3.15 upgrade; #52 remains open.