jobtrackingapp/docs/redesign/phase-9/p9-sec-02/DEPENDENCY_REMEDIATION.md

SEC-M03 — bounded dependency remediation and actual runtime qualification

Application lock:49→55 packages; six existing versions change, two obsolete transitive dependencies disappear and eight required transitive dependencies enter through the reviewed major-library transitions. This is not an unrestricted upgrade. Exact changes and new graph identities are in dependency-checkpoint.json.

Owner	Before	After	Reason
filelock	3.32.4	4.2.1	Published fixes; explicit cache security constraint, native/soft/Hub contention qualified
Torch CPU	2.6.0+cpu	2.13.0+cpu	Latest first-patched bound among reviewed fixable records; actual official CPU wheel, no CUDA download
Transformers	4.48.3	5.10.0	Reviewed fixed bounds; real BART/tokenizer/generation/API qualification
Hub	0.36.2	1.33.0	Required compatible1.x dependency, exact locked/tested choice
tokenizers	0.21.4	0.22.2	Required compatible ABI range, actual pinned BART tokenizer/Unicode roundtrip
sympy	1.13.1	1.14.0	Torch dependency requirement

New required graph members: httpcore,httpx,markdown-it-py,mdurl,pygments,rich,shellingham,typer. Requests and charset-normalizer leave this resolved graph; existing reviewed TLS/build constraints remain. Forty-one old pins are unchanged. All55 downloaded Linux wheels were hash-checked and match the committed lock; the real Dockerfile also installs with --require-hashes.

The new requirements-dev-linux.lock preserves every one of the55 runtime pins and adds exactly six existing-test dependency requirements. Broader installed-environment scanning found one additional alias group, pytest CVE-2025-71176/GHSA-6w46-j5rx-g56g (four overlapping provider records), beyond the original109 application groups. Vendor9.0.3 and the fix identify the temporary-directory repair. The dev pin changes8.3.5→9.0.3, the test lock is regenerated and the complete59-case Linux suite passes without warnings. No test assertion is weakened. The other test-only packages are httpcore2,httpx2,iniconfig,pluggy,truststore; bootstrap pip/wheel are separately inventoried. Neither pytest nor these test extras are added to the application lock.

Real supported runtime

The actual source Dockerfile was rebuilt locally with Python3.12.10/Debian12, the exact55-package CPU lock and native Tesseract5.3.0. A derived, network-free qualification layer adds only the six hashed test extras. RUNTIME.json records the two actual local image IDs; these are not pullable registry manifest references and no image was uploaded or deployed.

The initial real build revealed stale .venv-lock-check/.venv.stale-* directories entering the context. Only that owned build client/plugin was cancelled; its log/outcome remain. Changing .dockerignore from .venv to .venv* reduces the clean context to602.86kB. Actual image inventory verifies no /app/.venv* exists. Existing local directories and Docker services are untouched.

qualification.json contains actual process outcomes, input hashes and results. All lanes run without an application-source mount: the code is the built source image, checked by SHA256 against the working source. Nonroot65534, read-only root/fixture/helper mounts, network none, private tmpfs, twoCPU,2GiB,128PIDs and a180-second parent deadline are enforced. Containers are verified absent afterward.

• Complete sidecar:59/59, zero failed/skipped, using pytest9.0.3 and the actual61-package application/test lock.
• Safetensors and restricted PyTorch-state profiles: real BART class/tokenizer/native CPU generation, exact Norwegian tokenizer roundtrip,1024-token truncation, finite logits, short/long generation, actual summary/auth/repeat-cache contract. Each profile stays below one second after imports in this bounded fixture; this is not a full-model latency claim.
• Cache: five real artifact-integrity failures rejected before loading; native/soft/Hub cross-process contention expires, then acquires after release; missing offline model returns503 with no partially loaded state. Separate same-version Windows native/soft contention passes. No shared-cache upgrade or Windows ACL/symlink attack is claimed.
• Parsers: actual resource-bounded TXT/DOCX/PDF children preserve Norwegian content; native OCR on synthetic PNG and image-only PDF preserves the expected phrase. Actual uvicorn readiness/authenticated summary/cache and upload extraction pass over container loopback; the owned server stops afterward. English traineddata SHA256 is retained.
• Inventory: Python/native package versions, all55 installed pins,61 test pins plus bootstrap pip/wheel (63 distributions total), pip check, CPU build details, code hashes and OCR artifact hash are recorded.

The first52PASS/7FAIL Linux suite is retained: an empty harness Ollama URL failed URL construction before seven existing mocks. Its corrected loopback-only successor passed59/59. Early httpx fallback deprecations are retained; the final exact test layer uses the existing supported httpx2 requirement and has no warning. Earlier model/profile runs and focused checks are not added to final suite totals.

Security accounting and limits

Exact installed queries cover63 distributions/126 requests, zero advisory records. OSV accepts the exact CPU local version; PyPI returns404 for torch==2.13.0+cpu. That known second-provider coverage gap is retained as INCOMPLETE rather than reported as a clean request. The official CPU wheel identity/hash and current vendor/security source assessment provide separate evidence. Application55 queries likewise have zero records and the same vendor-release limitation. No suppression or owner risk acceptance is asserted.

Original109 groups remain traceable as65 previous repairs plus44 individual follow-ups. The current source assessment supports ten explicitly scoped non-applicability dispositions (unshipped/unused conversion, alternate architectures, export archive loader and the disputed numeric chain); it does not claim those upstream flaws globally fixed. Full final dispositions and Phase9 gates are reconciled after broad regression.

Full trained DistilBART, semantic quality, GPU, production cache ownership/migration, real device/provider/manual acceptance and live filesystem/recovery state remain unqualified. The source Dockerfile still has mutable base/apt/bootstrap inputs: this measured immutable local image is retained, while a future rebuild must record its actual identities and requalify. Production digest/supply-chain pinning and release approval remain separate gates. The bounded worker deadline/parser cancellation controls do not establish application-level cancellation of in-flight full-model inference.

The trained-checkpoint successor is reported separately in the final validation/addendum; the preceding sentence records the earlier small-fixture checkpoint boundary. Native Windows unit execution on the retained old virtualenv is predecessor/tooling evidence only. That old graph is not patched-service qualification and must not be used to claim safe untrusted-document processing. Use the exact qualified Linux image and hash locks for the supported tested service. No native virtualenv or production installation was deleted, reset or silently relabelled as updated.

Final25October successor: the configured trained checkpoint passes real CPU loading/generation and offline repository-cache/API contracts under the patched graph. The six current runtime lanes also pass with positive bounded cleanup evidence. All109 original advisory groups have individual dispositions (99 fixed/version-verified,10 narrowly not affected); the additional pytest group is fixed. The final63-distribution scan has0records and the retained vendor PyPI404, so scan coverage remains INCOMPLETE and the independently scoped security decision is CONDITIONAL PASS. Full-image/stdlib/native advisory coverage, old native virtualenvs, semantic/GPU/production qualification are not granted by that decision.