fix-cve

name	fix-cve
description	Fix CVE vulnerabilities by upgrading affected dependencies across Python (uv), Go, and Rust layers. Use when the user mentions CVE numbers, asks to fix security vulnerabilities, or asks to patch dependencies for CVEs.

Fix CVE

Fixes one or more CVE vulnerabilities in the multi-storage-client repository by identifying and upgrading affected dependencies.

Input

The user provides one or more CVE identifiers (e.g. CVE-2026-27459).

Workflow

Copy this checklist and track progress with TodoWrite:

- [ ] Step 1: Research each CVE
- [ ] Step 2: Locate affected dependencies
- [ ] Step 3: Plan fixes (present to user)
- [ ] Step 4: Apply fixes
- [ ] Step 5: Verify lock files and builds
- [ ] Step 6: Output commit message and PR description

Step 1: Research each CVE

For each CVE, web-search for:

• Affected package name and vulnerable version range
• Fixed version (minimum safe version)
• CVSS score and severity

Collect into a table:

CVE	Package	Vulnerable	Fixed	CVSS	Severity

Step 2: Locate affected dependencies

Search the repo for each affected package across all layers:

Layer	Files to check
Python direct	multi-storage-client/pyproject.toml [project.dependencies] and [project.optional-dependencies]
Python transitive	uv.lock — grep for the package name
Go direct	multi-storage-file-system/go.mod require blocks
Go transitive	multi-storage-file-system/go.sum
Rust	rust/Cargo.toml and rust/Cargo.lock

If a package is not found anywhere, tell the user and skip it.

Step 3: Plan fixes (present to user before proceeding)

For each affected dependency, determine the fix strategy:

Python direct dependency

Bump the version floor in multi-storage-client/pyproject.toml. If the upper bound excludes the fixed version, widen it.

Python transitive dependency

Check whether the parent package (the one that pulls it in) has a version that already requires the fixed version. If so, bump the parent's floor.

If no parent version solves it, determine whether a constraint-dependencies entry or an override-dependencies entry is needed:

• Use constraint-dependencies (preferred) when the upstream allows the fixed version but the lowest-direct resolver picks an older one. A constraint tightens the floor without conflicting with upstream bounds.
• Use override-dependencies (last resort) only when an upstream package has an explicit upper bound that blocks the fixed version. Overrides silently ignore upstream constraints and should be documented with a comment explaining why.

To test which is needed: try constraint-dependencies first. If uv lock fails with an unsolvable conflict, the upstream has a blocking upper bound and an override is required.

Both live in the workspace-root pyproject.toml under [tool.uv].

Go dependency

cd multi-storage-file-system
go get <module>@<fixed-version>
go mod tidy

Rust dependency

Edit rust/Cargo.toml version requirement, then cargo update -p <crate>.

Step 4: Apply fixes

Apply each fix. After modifying Python constraints/overrides, regenerate the lock file:

uv lock --upgrade-package <package1> --upgrade-package <package2>

Verify the lock file contains the expected versions:

grep -A2 'name = "<package>"' uv.lock

Step 5: Verify builds

Layer	Verification command
Go	cd multi-storage-file-system && go build ./...
Python	just multi-storage-client/run-unit-tests (or cd multi-storage-client && uv run pytest)
Rust	cd rust && cargo test

Only run verification for layers that were changed.

Step 6: Output commit message and PR description

Commit message format

Single line only — no body.

fix: upgrade <packages> for <CVE list>

Example:

fix: upgrade grpc-go, pyOpenSSL, and authlib for CVE-2026-33186, CVE-2026-27459, CVE-2026-27962

PR description format

## Summary
- <Bullet per CVE: ID, severity, package, what the vulnerability allows, fixed version.>

## Changes
- <Bullet per file changed and what was done.>

## Override justification
<If any override-dependencies were added, explain why a constraint was
insufficient (which upstream package blocks the fixed version and what its
upper bound is). If no overrides, omit this section.>

## Test plan
 [ ] Go module builds: 
 [ ] Python unit tests pass
 [ ] Lock file contains expected versions
 [ ] No new linter errors

Key decisions to confirm with user

• If an override is the only option, explain why and ask for confirmation.
• If a fix requires widening an upper bound on a direct dependency (e.g. cryptography>=44,<46 → <47), flag the change and its implications.
• If a CVE affects a package not in the dependency tree, report it and skip.