fix(backend): clear click PYSEC-2026-2132 + waive unfixable cryptography CVEs (CI #536)

.github/workflows/deploy.yml

@@ -55,7 +55,18 @@ jobs:
       # citing the upstream issue and the date we plan to revisit.
       - name: Dependency scan (pip-audit)
         working-directory: backend
-        run: uv run pip-audit --strict
+        run: |
+          uv run pip-audit --strict \
+            --ignore-vuln CVE-2026-69247 \
+            --ignore-vuln CVE-2026-69248 \
+            --ignore-vuln CVE-2026-69249
+        # cryptography 48.0.1 advisories waived 2026-08-03:
+        #   CVE-2026-69248 (fix 49.0.0), CVE-2026-69249 (fix 49.0.0),
+        #   CVE-2026-69247 (fix 50.0.0).
+        # 48.0.1 is the highest version clerk-backend-api allows (every
+        # clerk release caps cryptography below 49.0.0), so no forward
+        # fix is resolvable until clerk relaxes its upper bound.  See
+        # backend/pyproject.toml constraint-dependencies comment.
 
       - name: Run tests
         working-directory: backend

.github/workflows/weekly-deps-refresh.yml

@@ -62,7 +62,11 @@ jobs:
         run: uv run ruff check
       - name: Backend dependency scan (pip-audit --strict)
         working-directory: backend
-        run: uv run pip-audit --strict
+        run: |
+          uv run pip-audit --strict \
+            --ignore-vuln CVE-2026-69247 \
+            --ignore-vuln CVE-2026-69248 \
+            --ignore-vuln CVE-2026-69249
       - name: Backend tests
         working-directory: backend
         run: uv run pytest -q

backend/pyproject.toml

@@ -158,8 +158,16 @@ constraint-dependencies = [
     "starlette>=1.3.1",
     "pip>=26.1.2",
     # cryptography: GHSA-537c-gmf6-5ccf (fixed in 48.0.1). Transitive via
-    # clerk-backend-api / authlib. Remove once a direct dep's own pin
-    # clears cryptography 48.0.1.
+    # clerk-backend-api / authlib. Pinned at 48.0.1 (the highest version
+    # clerk-backend-api allows — every clerk release caps cryptography
+    # below 49.0.0). Three further advisories — CVE-2026-69248,
+    # CVE-2026-69249 (both fixed in 49.0.0) and CVE-2026-69247 (fixed in
+    # 50.0.0) — landed ~2026-08-03 and affect 48.0.1, but no forward fix
+    # is resolvable: clerk-backend-api<49.0.0 makes 48.0.1 the ceiling.
+    # These three are waived in the CI pip-audit step via --ignore-vuln
+    # (see .github/workflows/deploy.yml) pending clerk relaxing its
+    # upper bound. Remove the ignore flags + this comment once clerk
+    # ships a version allowing cryptography >=49.0.0.
     "cryptography>=48.0.1",
     # joserfc: CVE-2026-48990 (fixed in 1.6.7). Transitive via
     # clerk-backend-api. Remove once clerk's own pin clears 1.6.7.
@@ -170,4 +178,12 @@ constraint-dependencies = [
     # pydantic-settings: GHSA-4xgf-cpjx-pc3j (fixed in 2.14.2). Transitive
     # via fastmcp. Remove once fastmcp's own pin clears 2.14.2.
     "pydantic-settings>=2.14.2",
+    # click: PYSEC-2026-2132 (fixed in 8.3.3). Transitive via uvicorn
+    # (and any CLI tooling that pulls click). The advisory landed
+    # ~2026-08-03 and turned pip-audit --strict red even though no code
+    # changed. Patch bump 8.3.1 → 8.3.3 is API-safe. uv resolves the
+    # constraint to the latest compatible (8.4.2 at time of writing),
+    # still well within uvicorn's click range. Remove this line once
+    # uvicorn's own click pin clears 8.3.3.
+    "click>=8.3.3",
 ]