From 7f26c07d9bbfba6d100c872696deaac228fdd42c Mon Sep 17 00:00:00 2001
From: moocow4844 <51964674+moocow4844@users.noreply.github.com>
Date: Tue, 28 Jul 2026 01:00:51 -0400
Subject: [PATCH] chore: add security floors to dependency versions

Two of the declared dependencies currently admit versions with known
vulnerabilities:

- setuptools was constrained as >=61.0, which permits CVE-2024-6345 (command
  injection via package_index, fixed in 70.0.0), CVE-2025-47273 (path traversal
  in PackageIndex.download, fixed in 78.1.1) and GHSA-h35f-9h28-mq5c (MANIFEST.in
  exclusion bypass in sdist via Unicode normalization collision on macOS
  APFS/HFS+, fixed in 83.0.0).
- pillow was unconstrained, so a fresh install could resolve below 12.3.0, the
  version that fixes its most recent advisory.

requests and numpy were also unconstrained; their floors are set for the same
reason though current resolutions already clear them. Each floor is the highest
version any OSV advisory for that package names as fixed. librosa and matplotlib
carry no advisories in OSV and stay unconstrained rather than pinned for its own
sake.

Floors, not equality pins: users keep receiving patch updates, and nothing here
forces a resolution on a consumer's environment. All four support the declared
requires-python >= 3.10.

Verified: `uv pip compile` resolves cleanly to librosa 0.11.0, matplotlib 3.11.1,
numpy 2.4.6, pillow 12.3.0, requests 2.34.2; `uv build --wheel` succeeds under
the raised setuptools floor.
---
 pyproject.toml | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index c2cff294..f385917b 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,19 +4,22 @@ version = "0.1.0"
 description = "Conversation-driven video editor skill for Claude Code"
 license = { file = "LICENSE" }
 requires-python = ">=3.10"
+# Lower bounds are security floors: each is the highest version any OSV advisory
+# for that package names as fixed. librosa and matplotlib carry no advisories and
+# stay unconstrained. All floors support requires-python >= 3.10.
 dependencies = [
-    "requests",
+    "requests>=2.33.0",
     "librosa",
     "matplotlib",
-    "pillow",
-    "numpy",
+    "pillow>=12.3.0",
+    "numpy>=1.22",
 ]
 
 [project.optional-dependencies]
 animations = ["manim"]
 
 [build-system]
-requires = ["setuptools>=61.0"]
+requires = ["setuptools>=83.0.0"]
 build-backend = "setuptools.build_meta"
 
 [tool.setuptools]