permit 3.0.0: fix dependency CVEs, fix major SDK bugs, gate PRs and releases on CVE scans - #126

Merged

zeevmoney merged 92 commits into

mainfrom

per-16176/cve-gates-and-fixes

Sep 28, 2026

Commits on Sep 21, 2026

Fix dependency CVEs and gate PRs, releases and a weekly scan

zeevmoney
and
claude
committed
7d1c214
Move httpserver_listen_address to conftest so the port is order-independent

zeevmoney
and
claude
committed
e5a88c1
TEMP: revert permit/ to origin/main to isolate test_bulk_operations

zeevmoney
and
claude
committed
160f129
Revert "TEMP: revert permit/ to origin/main to isolate test_bulk_operations"
zeevmoney
committed
f9b4857

Commits on Sep 22, 2026

Document the resource instance ident format correctly

zeevmoney
and
claude
committed
95a1860
Fix the major correctness bugs and enable the xfail tests for 3.0.0

zeevmoney
and
claude
committed
1e6b9e6
Isolate the end-to-end tests and start the PDP with the env's own key

zeevmoney
and
claude
committed
199c4be
Give the PDP time to warm up and ABAC policy time to propagate

zeevmoney
and
claude
committed
3d11c3a
Remove dead code and dead dependencies for 3.0.0

zeevmoney
and
claude
committed
e7ce61d
Skip only the ABAC decision assertions, with the evidence

zeevmoney
and
claude
committed
c439afb
Fix resource_relations.list() and document two backend contracts

zeevmoney
and
claude
committed
98ea10a
Tolerate rate limiting during test teardown

zeevmoney
and
claude
committed
e86f630
Retry rate-limited requests instead of tolerating them

zeevmoney
and
claude
committed
0865f96
Make the rate-limit retry more patient

zeevmoney
and
claude
committed
0146bb8
Point the ABAC skip at PER-16209

zeevmoney
and
claude
committed
e33c160
Make CheckQuery.context optional for type checkers

zeevmoney
and
claude
committed
5391be2

Commits on Sep 23, 2026

Send the standard "Bearer" scheme in every Authorization header

committed
9f795f8
Support Python 3.14 and raise dependency floors that no longer install

zeevmoney
and
claude
committed
306032f
Ship a typed public surface with py.typed (PEP 561)

committed
d6aa721
Reduce the ABAC skip to its ticket reference

zeevmoney
and
claude
committed
1696305
Format the ABAC skip

zeevmoney
and
claude
committed
76ed0ab

Commits on Sep 24, 2026

Exclude pydantic 2 releases that bundle a vulnerable pydantic.v1

zeevmoney
and
claude
committed
ba3ab05
Say why setup.py still lists the type files in package_data

zeevmoney
and
claude
committed
92f4e65
Remove references to non-public code from comments

zeevmoney
and
claude
committed
b4e7a69
Build the pydantic candidate grid with loops; drop a no-op mkdir

zeevmoney
and
claude
committed
0e3bd01
Accept audit logs without pdp_config_id or from the GENERIC engine

zeevmoney
and
claude
committed
87b5f35
Check that only GENERIC logs parse as GenericEngineDecisionLog

zeevmoney
and
claude
committed
aae3163
Test that the blocking client keeps parity with the async one

zeevmoney
and
claude
committed
69e356a
Cover instance attributes and back-references in the parity test

zeevmoney
and
claude
committed
027a107
Bind the test HTTP server to a free port

zeevmoney
and
claude
committed
8aea675
Mark credentialed tests e2e and run the rest offline

zeevmoney
and
claude
committed
e826d87
Delete the invite test's resource instance by resource:key

zeevmoney
and
claude
committed
f6a6296
Send the facade's assign_role and unassign_role through users

zeevmoney
and
claude
committed
3d1008c
Say the deprecated permit.api methods go away in 4.0

zeevmoney
and
claude
committed
bea1d74
Test resource actions and action groups offline

zeevmoney
and
claude
committed
e69a717
Drain the timeout tests' late requests before the next test

zeevmoney
and
claude
committed
008b9c8
Check every DeprecationWarning in the facade test

zeevmoney
and
claude
committed
029a894
Pass models as well as dicts to the deprecated facade in its test

zeevmoney
and
claude
committed
db2daac
Fail test_envs.py fast when its API keys are not set

zeevmoney
and
claude
committed
47fc662
Warn on import when permit runs on pydantic 1

zeevmoney
and
claude
committed
0686201
Document what permit 4.0 removes

zeevmoney
and
claude
committed
6db7fdf
Keep the warnings module out of permit's public names

zeevmoney
and
claude
committed
ba653a2
Say how to show or silence the 4.0 deprecation warnings

zeevmoney
and
claude
committed
d822667
Name pip-audit gaps in the audit report and Slack message

zeevmoney
and
claude
committed
a0158b1
Run pip-audit on every tree without building a venv

zeevmoney
and
claude
committed
4333fa7
Move the artifact and Slack actions to their Node 24 releases

zeevmoney
and
claude
committed
c0352bc
Run pre-commit without the Node 20 cache action

zeevmoney
and
claude
committed
b4f20fc
Drop the actionlint input the action does not declare

zeevmoney
and
claude
committed
1f9723e
Keep the SDK's pytest.ini out of the audit script tests

zeevmoney
and
claude
committed
ff25ea9
Pin every job to the ubuntu-24.04 runner

zeevmoney
and
claude
committed
106fb42
Post the audit PR comment the hashFiles guard always skipped

zeevmoney
and
claude
committed
5f87275
Drop the private pip-audit cache directory

zeevmoney
and
claude
committed
68f0917
Name only the tree in the Slack pip-audit gap line

zeevmoney
and
claude
committed
df74adc
Keep the Trivy install step from logging a scan warning

zeevmoney
and
claude
committed
f0314b2
Correct two outdated comments in the Security workflow

zeevmoney
and
claude
committed
43a9da3

Commits on Sep 25, 2026

Publish the package under Permit.io and use a fictional test user

zeevmoney
and
claude
committed
e264607
Share the offline test config and request helpers

zeevmoney
and
claude
committed
c41a601
Point the blocking client's deprecation warnings at the caller

zeevmoney
and
claude
committed
5b4db08
Keep PYDANTIC_VERSION out of permit's public names

zeevmoney
and
claude
committed
ab6590c
Stop passing module globals when warning at a blocking call

zeevmoney
and
claude
committed
89225b1
Keep run_coroutine_sync's one-argument call and new names private

zeevmoney
and
claude
committed
09feaa3
Test the once-per-line warning and the no-caller case in a script

zeevmoney
and
claude
committed
caa7258
Note the private PYDANTIC_VERSION alias in the model header steps

zeevmoney
and
claude
committed
3948d0c
Add offline regression tests for request bodies and API calls

zeevmoney
and
claude
committed
26f9efc
Check permit/api/models.py against the live API schema

zeevmoney
and
claude
committed
d79fb47
Accept wildcard relationship tuples and NATS PDP API keys

zeevmoney
and
claude
committed
fd67abe
Pin the PDP route of each single-object facts write

zeevmoney
and
claude
committed
aef7f5a
Retry the schema download and exit 2 on any drift-check error

zeevmoney
and
claude
committed
81325bc
Time-limit the Schema Drift jobs and post manual runs to Slack

zeevmoney
and
claude
committed
8b31c6c
Give the generator cutoff as a UTC time and correct the drift docs

zeevmoney
and
claude
committed
8559e3e

Commits on Sep 27, 2026

Add an agent skill that migrates projects from permit 2.x to 3.0.0

zeevmoney
and
claude
committed
1773379
Add a guide for upgrading from permit 2.x to 3.0.0

zeevmoney
and
claude
committed
89b956a
Test the migration scanner, skill and guide offline

zeevmoney
and
claude
committed
e3a158b
Link the migration guide and skill from the README

zeevmoney
and
claude
committed
ba3b1f1
Track the migration fixtures' .python-version files

zeevmoney
and
claude
committed
fd97907
Resolve names by scope in the migration scanner

zeevmoney
and
claude
committed
feb4ecb
Ask before dropping await on the blocking client

zeevmoney
and
claude
committed
4d112e2
Treat compiled requirements files as locks in the scanner

zeevmoney
and
claude
committed
c54d1fa
Correct the A4 advice for DetailedAuditLogModel.objects

zeevmoney
and
claude
committed
84c504a
List certifi, sniffio and exceptiongroup under C2

zeevmoney
and
claude
committed
9b01bdb
Report T2 on names annotated with an SDK model

zeevmoney
and
claude
committed
b4b659f
Flag warning filters written for 2.x's deprecation text

zeevmoney
and
claude
committed
750172b
Describe ContextStore.transform() as 2.x ran it

zeevmoney
and
claude
committed
9a4ffef
Stop the migration skill on any Python pin below 3.10

zeevmoney
and
claude
committed
fead785
Correct and complete the upgrade guide's details

zeevmoney
and
claude
committed
1c95fb0
Test the guide's code, commands and tables against 3.0

zeevmoney
and
claude
committed
a177719
Align the remaining A3 and C2 mentions with the fixes

zeevmoney
and
claude
committed
ef567ee
Accept 3.14's TypeError from asyncio.run in the A2 guide test

zeevmoney
and
claude
committed
96db617
Leave bytecode caches out of the fixture tracking test

zeevmoney
and
claude
committed
ea6caf1
Store the migration sample apps' dependency files as *.fixture

zeevmoney
and
claude
committed
b7ac9d6
Move the migration skill's tests to skills/tests

zeevmoney
and
claude
committed
ce70476
Describe permit 4.0 as a future release

zeevmoney
and
claude
committed
e01c59a