fix-python

name	fix-python
description	Apply a Python dependency CVE fix: bump requirements pin, regenerate requirements-build.txt with pybuild-deps, verify with pip-audit.
allowed-tools	["Bash(pybuild-deps *)","Bash(pip-audit *)","Bash(pip *)","Bash(pip3 *)","Bash(sed *)","Bash(grep *)","Bash(cat *)","Read","Write","Edit","Glob","Grep"]

Fix Python CVE

Inputs

Input	Required
PACKAGE	yes
FIXED_VERSION	yes
CVE_ID	yes
REPO_DIR	yes (cwd)
CVE_PYBUILD_SETUPTOOLS_WORKAROUND	optional, default false

Steps

1. Find requirements file

REQ_FILE=""
for f in requirements.txt requirements-dev.txt; do
  if grep -qi "^${PACKAGE}" "$f" 2>/dev/null; then
    REQ_FILE="$f"
    break
  fi
done

2. Bump version pin

ESCAPED_PACKAGE=$(printf '%s\n' "$PACKAGE" | sed 's/[.[\*^$]/\\&/g')
sed -i "s/^${ESCAPED_PACKAGE}[=>~!][=<>~!]*.*$/${PACKAGE}>=${FIXED_VERSION}/" "$REQ_FILE"

3. Regenerate requirements-build.txt

pybuild-deps compile --generate-hashes --output-file=requirements-build.txt requirements.txt

if [ "${CVE_PYBUILD_SETUPTOOLS_WORKAROUND:-false}" = "true" ]; then
  sed -i '/^setuptools==82\b/d' requirements-build.txt
fi

4. Verify

grep "${PACKAGE}" requirements-build.txt
pip-audit -r requirements.txt 2>/dev/null | grep -i "${CVE_ID}" && \
  echo "WARNING: CVE still detected" || echo "CVE resolved in scan"

Output

Modified requirements*.txt and requirements-build.txt in REPO_DIR.