[olivermeyer]

Why?
The scheduled audit job fails because pip-audit finds CVE-2026-119284 in joserfc 1.7.5 and CVE-2026-119194..7 in pyasn1 0.6.4 (run 41403960681). Both are transitive dependencies that ship to SDK users.

How?
Raise the transitive lower bound for pyasn1 to >=0.6.5 and add joserfc>=1.7.6 to the existing CVE override list in pyproject.toml, then re-lock (joserfc 1.7.7, pyasn1 0.6.5). The lower bounds also protect consumers who resolve without our lock file.

🤖 Generated with Claude Code

[ox-security]

OX Security reviewed this pull request — nothing to fix.

✔ No issues found

Branch fix/audit-joserfc-pyasn1-cves → main

View scan in OX Security →

[claude]

Claude finished @olivermeyer's task in 3m 5s —— View job

---

Review Complete: PR #760 - CVE Fixes for joserfc and pyasn1

Task: Review dependency updates addressing CVE-2026-119284 (joserfc) and CVE-2026-119194..7 (pyasn1)

---

✅ CRITICAL CHECKS (All Passed)

1. Conventional Commits ✅

• Commit: fix(deps): raise joserfc and pyasn1 to fix CVEs
• Format: Correct (type: fix, scope: deps, clear description)

2. Code Quality ✅

✓ ruff check: All checks passed
✓ ruff format: 287 files already formatted  
✓ pyright: 0 errors, 0 warnings, 0 informations
✓ mypy: Success: no issues found in 84 source files

3. Test Markers ✅

• No new tests added (expected for dependency update)
• No existing tests modified

4. Dependency Changes ✅

pyproject.toml:

- "pyasn1>=0.6.3",  # CVE-2026-30922 (>=0.6.3)
+ "pyasn1>=0.6.5",  # CVE-2026-30922 (>=0.6.3); CVE-2026-119194..7 (>=0.6.5)
+ "joserfc>=1.7.6", # CVE-2026-119284 (>=1.7.6); transitive via authlib/fastmcp

uv.lock:

• joserfc: 1.7.5 → 1.7.7 (exceeds minimum 1.7.6 ✅)
• pyasn1: 0.6.4 → 0.6.5 (matches requirement ✅)
• Lock file properly updated with new SHA256 hashes

---

✅ REPOSITORY-SPECIFIC CHECKS

5. Maintenance Mode Compliance ✅
Per CLAUDE.md Section "Maintenance mode":

2. Accept dependency updates that fix vulnerabilities.

This PR correctly addresses security vulnerabilities without adding new features.

6. Architecture Compliance ✅

• No code changes, only dependency version constraints
• No impact on modulith architecture

7. CI/CD Status ✅

• Build Native Only: ✅ Passed (2/2 runs)
• CI/CD: ⏳ In progress
• No failures detected

8. Breaking Changes ✅

• No breaking changes
• Changes are backward compatible (raising minimum versions for security)
• Transitive dependencies properly constrained

9. Documentation ✅

• CVE references properly documented inline in pyproject.toml
• PR description clearly explains the "Why" and "How"

---

📋 Review Summary

This PR is a clean, minimal security fix that:

• ✅ Addresses two CVE families (joserfc CVE-2026-119284, pyasn1 CVE-2026-119194..7)
• ✅ Follows maintenance mode guidelines (accepts vulnerability fixes)
• ✅ Uses correct conventional commit format
• ✅ Passes all linting and type checks (ruff, pyright, mypy)
• ✅ Makes minimal, targeted changes (only 2 files)
• ✅ Properly documents CVE references inline
• ✅ Updates lock file correctly with proper hashes
• ✅ No test changes needed (dependency update only)

No blocking issues found. This PR is ready to merge once the CI/CD pipeline completes.

---

💡 Suggestions (Non-blocking)

None. The implementation follows all repository standards and best practices.

---

Verdict: ✅ claude:review:passed

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

❌ Your project check has failed because the head coverage (69.96%) is below the target coverage (70.00%). You can increase the head coverage or adjust the target coverage.
see 5 files with indirect coverage changes

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud