Repository navigation

permit 3.0.0: fix dependency CVEs, fix major SDK bugs, gate PRs and releases on CVE scans - #126

Merged

zeevmoney merged 92 commits into

mainfrom

per-16176/cve-gates-and-fixes

Sep 28, 2026

Commits on Sep 21, 2026
- Fix dependency CVEs and gate PRs, releases and a weekly scan
  
  zeevmoney
  and
  claude
  committed
  7d1c214
- Move httpserver_listen_address to conftest so the port is order-independent
  
  zeevmoney
  and
  claude
  committed
  e5a88c1
- TEMP: revert permit/ to origin/main to isolate test_bulk_operations
  
  zeevmoney
  and
  claude
  committed
  160f129
- Revert "TEMP: revert permit/ to origin/main to isolate test_bulk_operations"
  zeevmoney
  committed
  f9b4857
Commits on Sep 22, 2026
- Document the resource instance ident format correctly
  
  zeevmoney
  and
  claude
  committed
  95a1860
- Fix the major correctness bugs and enable the xfail tests for 3.0.0
  
  zeevmoney
  and
  claude
  committed
  1e6b9e6
- Isolate the end-to-end tests and start the PDP with the env's own key
  
  zeevmoney
  and
  claude
  committed
  199c4be
- Give the PDP time to warm up and ABAC policy time to propagate
  
  zeevmoney
  and
  claude
  committed
  3d11c3a
- Remove dead code and dead dependencies for 3.0.0
  
  zeevmoney
  and
  claude
  committed
  e7ce61d
- Skip only the ABAC decision assertions, with the evidence
  
  zeevmoney
  and
  claude
  committed
  c439afb
- Fix resource_relations.list() and document two backend contracts
  
  zeevmoney
  and
  claude
  committed
  98ea10a
- Tolerate rate limiting during test teardown
  
  zeevmoney
  and
  claude
  committed
  e86f630
- Retry rate-limited requests instead of tolerating them
  
  zeevmoney
  and
  claude
  committed
  0865f96
- Make the rate-limit retry more patient
  
  zeevmoney
  and
  claude
  committed
  0146bb8
- Point the ABAC skip at PER-16209
  
  zeevmoney
  and
  claude
  committed
  e33c160
- Make CheckQuery.context optional for type checkers
  
  zeevmoney
  and
  claude
  committed
  5391be2
Commits on Sep 23, 2026
- Send the standard "Bearer" scheme in every Authorization header
  
  committed
  9f795f8
- Support Python 3.14 and raise dependency floors that no longer install
  
  zeevmoney
  and
  claude
  committed
  306032f
- Ship a typed public surface with py.typed (PEP 561)
  
  committed
  d6aa721
- Reduce the ABAC skip to its ticket reference
  
  zeevmoney
  and
  claude
  committed
  1696305
- Format the ABAC skip
  
  zeevmoney
  and
  claude
  committed
  76ed0ab
Commits on Sep 24, 2026
- Exclude pydantic 2 releases that bundle a vulnerable pydantic.v1
  
  zeevmoney
  and
  claude
  committed
  ba3ab05
- Say why setup.py still lists the type files in package_data
  
  zeevmoney
  and
  claude
  committed
  92f4e65
- Remove references to non-public code from comments
  
  zeevmoney
  and
  claude
  committed
  b4e7a69
- Build the pydantic candidate grid with loops; drop a no-op mkdir
  
  zeevmoney
  and
  claude
  committed
  0e3bd01
- Accept audit logs without pdp_config_id or from the GENERIC engine
  
  zeevmoney
  and
  claude
  committed
  87b5f35
- Check that only GENERIC logs parse as GenericEngineDecisionLog
  
  zeevmoney
  and
  claude
  committed
  aae3163
- Test that the blocking client keeps parity with the async one
  
  zeevmoney
  and
  claude
  committed
  69e356a
- Cover instance attributes and back-references in the parity test
  
  zeevmoney
  and
  claude
  committed
  027a107
- Bind the test HTTP server to a free port
  
  zeevmoney
  and
  claude
  committed
  8aea675
- Mark credentialed tests e2e and run the rest offline
  
  zeevmoney
  and
  claude
  committed
  e826d87
- Delete the invite test's resource instance by resource:key
  
  zeevmoney
  and
  claude
  committed
  f6a6296
- Send the facade's assign_role and unassign_role through users
  
  zeevmoney
  and
  claude
  committed
  3d1008c
- Say the deprecated permit.api methods go away in 4.0
  
  zeevmoney
  and
  claude
  committed
  bea1d74
- Test resource actions and action groups offline
  
  zeevmoney
  and
  claude
  committed
  e69a717
- Drain the timeout tests' late requests before the next test
  
  zeevmoney
  and
  claude
  committed
  008b9c8
- Check every DeprecationWarning in the facade test
  
  zeevmoney
  and
  claude
  committed
  029a894
- Pass models as well as dicts to the deprecated facade in its test
  
  zeevmoney
  and
  claude
  committed
  db2daac
- Fail test_envs.py fast when its API keys are not set
  
  zeevmoney
  and
  claude
  committed
  47fc662
- Warn on import when permit runs on pydantic 1
  
  zeevmoney
  and
  claude
  committed
  0686201
- Document what permit 4.0 removes
  
  zeevmoney
  and
  claude
  committed
  6db7fdf
- Keep the warnings module out of permit's public names
  
  zeevmoney
  and
  claude
  committed
  ba653a2
- Say how to show or silence the 4.0 deprecation warnings
  
  zeevmoney
  and
  claude
  committed
  d822667
- Name pip-audit gaps in the audit report and Slack message
  
  zeevmoney
  and
  claude
  committed
  a0158b1
- Run pip-audit on every tree without building a venv
  
  zeevmoney
  and
  claude
  committed
  4333fa7
- Move the artifact and Slack actions to their Node 24 releases
  
  zeevmoney
  and
  claude
  committed
  c0352bc
- Run pre-commit without the Node 20 cache action
  
  zeevmoney
  and
  claude
  committed
  b4f20fc
- Drop the actionlint input the action does not declare
  
  zeevmoney
  and
  claude
  committed
  1f9723e
- Keep the SDK's pytest.ini out of the audit script tests
  
  zeevmoney
  and
  claude
  committed
  ff25ea9
- Pin every job to the ubuntu-24.04 runner
  
  zeevmoney
  and
  claude
  committed
  106fb42
- Post the audit PR comment the hashFiles guard always skipped
  
  zeevmoney
  and
  claude
  committed
  5f87275
- Drop the private pip-audit cache directory
  
  zeevmoney
  and
  claude
  committed
  68f0917
- Name only the tree in the Slack pip-audit gap line
  
  zeevmoney
  and
  claude
  committed
  df74adc
- Keep the Trivy install step from logging a scan warning
  
  zeevmoney
  and
  claude
  committed
  f0314b2
- Correct two outdated comments in the Security workflow
  
  zeevmoney
  and
  claude
  committed
  43a9da3
Commits on Sep 25, 2026
- Publish the package under Permit.io and use a fictional test user
  
  zeevmoney
  and
  claude
  committed
  e264607
- Share the offline test config and request helpers
  
  zeevmoney
  and
  claude
  committed
  c41a601
- Point the blocking client's deprecation warnings at the caller
  
  zeevmoney
  and
  claude
  committed
  5b4db08
- Keep PYDANTIC_VERSION out of permit's public names
  
  zeevmoney
  and
  claude
  committed
  ab6590c
- Stop passing module globals when warning at a blocking call
  
  zeevmoney
  and
  claude
  committed
  89225b1
- Keep run_coroutine_sync's one-argument call and new names private
  
  zeevmoney
  and
  claude
  committed
  09feaa3
- Test the once-per-line warning and the no-caller case in a script
  
  zeevmoney
  and
  claude
  committed
  caa7258
- Note the private PYDANTIC_VERSION alias in the model header steps
  
  zeevmoney
  and
  claude
  committed
  3948d0c
- Add offline regression tests for request bodies and API calls
  
  zeevmoney
  and
  claude
  committed
  26f9efc
- Check permit/api/models.py against the live API schema
  
  zeevmoney
  and
  claude
  committed
  d79fb47
- Accept wildcard relationship tuples and NATS PDP API keys
  
  zeevmoney
  and
  claude
  committed
  fd67abe
- Pin the PDP route of each single-object facts write
  
  zeevmoney
  and
  claude
  committed
  aef7f5a
- Retry the schema download and exit 2 on any drift-check error
  
  zeevmoney
  and
  claude
  committed
  81325bc
- Time-limit the Schema Drift jobs and post manual runs to Slack
  
  zeevmoney
  and
  claude
  committed
  8b31c6c
- Give the generator cutoff as a UTC time and correct the drift docs
  
  zeevmoney
  and
  claude
  committed
  8559e3e
Commits on Sep 27, 2026
- Add an agent skill that migrates projects from permit 2.x to 3.0.0
  
  zeevmoney
  and
  claude
  committed
  1773379
- Add a guide for upgrading from permit 2.x to 3.0.0
  
  zeevmoney
  and
  claude
  committed
  89b956a
- Test the migration scanner, skill and guide offline
  
  zeevmoney
  and
  claude
  committed
  e3a158b
- Link the migration guide and skill from the README
  
  zeevmoney
  and
  claude
  committed
  ba3b1f1
- Track the migration fixtures' .python-version files
  
  zeevmoney
  and
  claude
  committed
  fd97907
- Resolve names by scope in the migration scanner
  
  zeevmoney
  and
  claude
  committed
  feb4ecb
- Ask before dropping await on the blocking client
  
  zeevmoney
  and
  claude
  committed
  4d112e2
- Treat compiled requirements files as locks in the scanner
  
  zeevmoney
  and
  claude
  committed
  c54d1fa
- Correct the A4 advice for DetailedAuditLogModel.objects
  
  zeevmoney
  and
  claude
  committed
  84c504a
- List certifi, sniffio and exceptiongroup under C2
  
  zeevmoney
  and
  claude
  committed
  9b01bdb
- Report T2 on names annotated with an SDK model
  
  zeevmoney
  and
  claude
  committed
  b4b659f
- Flag warning filters written for 2.x's deprecation text
  
  zeevmoney
  and
  claude
  committed
  750172b
- Describe ContextStore.transform() as 2.x ran it
  
  zeevmoney
  and
  claude
  committed
  9a4ffef
- Stop the migration skill on any Python pin below 3.10
  
  zeevmoney
  and
  claude
  committed
  fead785
- Correct and complete the upgrade guide's details
  
  zeevmoney
  and
  claude
  committed
  1c95fb0
- Test the guide's code, commands and tables against 3.0
  
  zeevmoney
  and
  claude
  committed
  a177719
- Align the remaining A3 and C2 mentions with the fixes
  
  zeevmoney
  and
  claude
  committed
  ef567ee
- Accept 3.14's TypeError from asyncio.run in the A2 guide test
  
  zeevmoney
  and
  claude
  committed
  96db617
- Leave bytecode caches out of the fixture tracking test
  
  zeevmoney
  and
  claude
  committed
  ea6caf1
- Store the migration sample apps' dependency files as *.fixture
  
  zeevmoney
  and
  claude
  committed
  b7ac9d6
- Move the migration skill's tests to skills/tests
  
  zeevmoney
  and
  claude
  committed
  ce70476
- Describe permit 4.0 as a future release
  
  zeevmoney
  and
  claude
  committed
  e01c59a

Commits

Commits on Sep 21, 2026

Commits on Sep 22, 2026

Commits on Sep 23, 2026

Commits on Sep 24, 2026

Commits on Sep 25, 2026

Commits on Sep 27, 2026