Security: 19 CVE fixes for NSPECT-S62Q-PZUD (collection, 2 children)

[nv-rag-cve-bot]

Summary

Fixes 19 Critical/High CVEs from nSpect collection NSPECT-S62Q-PZUD ("Foundational RAG Downloadable NIM Agent Blueprint"), covering both child programs:

• NSPECT-UV6I-R3V9 — Container (source CVEs, 19 fixed)
• NSPECT-O8B9-SHZ8 — Helm Chart (same source repo; no separate changes needed)

CVE	Severity	Surface	Package	Fix	Track	Validation
CVE-2026-48776 / GHSA-w39p-vh2g-g8g5	Critical	source	langgraph-sdk 0.3.3→0.4.2	manifest+lockfile bump	A	re-scan clean
GHSA-f4xh-w4cj-qxq8 / CVE-2026-45134	High	source	langsmith 0.8.5→0.10.0	manifest+lockfile bump	A	re-scan clean
CVE-2026-55443 / GHSA-gr75-jv2w-4656	High	source	langchain 1.3.1→1.3.12	manifest+lockfile bump	A	re-scan clean
CVE-2026-50269 / GHSA-m6qw-4cw2-hm4m	High	source	aiohttp 3.13.5→3.14.1	manifest+lockfile bump	A	re-scan clean
CVE-2026-54274/54277/54279/54280 (4)	High	source	aiohttp 3.13.5→3.14.1	manifest+lockfile bump	A	re-scan clean
CVE-2026-48817/48818 + PYSEC-2026-248/249 (4)	High	source	starlette 0.50.0→1.3.1 (via fastapi 0.128→0.139)	manifest+lockfile bump	A	re-scan clean
GHSA-8rfp-98v4-mmr6	High	source	bleach 6.3.0→6.4.0	manifest+lockfile bump	A	re-scan clean
GHSA-537c-gmf6-5ccf	High	source	cryptography 48.0.0→49.0.0	manifest+lockfile bump	A	re-scan clean
CVE-2026-53538/53539/53540 (3)	High	source	python-multipart 0.0.29→0.0.32	manifest+lockfile bump	A	re-scan clean
GHSA-4xgf-cpjx-pc3j	High	source	pydantic-settings 2.12.0→2.14.2	manifest+lockfile bump	A	re-scan clean
GHSA-rgxp-2hwp-jwgg / CVE-2026-25087	High	source	pyarrow 21.0.0→23.0.1	manifest+lockfile bump	A	re-scan clean

API compat note: starlette 1.x renamed HTTP_422_UNPROCESSABLE_ENTITY → HTTP_422_UNPROCESSABLE_CONTENT. Both rag_server/server.py and ingestor_server/server.py updated with an import alias to remain compatible with existing call-sites.

Validation

Local validation

• Re-scan (pip-audit against uv.lock export): ✅ 0 findings (all 19 CVE groups cleared)
• Full CVE sweep: ✅ 0 critical/high findings in updated lockfile
• Re-scan (nSpect source surface): ⏳ Pending nSpect re-ingest of release-v2.6.0 branch after merge — expected lag; scanner targets the branch, not the working tree

Pipeline validation (--validate pipeline)

• Pipeline: https://github.com/NVIDIA-AI-Blueprints/rag/actions/runs/28990304904 (project chat-labs/OpenSource/rag / GitHub Actions)
• Risk gating (Phase 9a): major + API change + --ci-wait-gpu → full chain including GPU Integration Tests
• Fix-loop iterations: 0 of 3

Gating jobs:

Job	Status
lint	✅ success
Unit Tests	✅ success
Frontend Unit Tests	✅ success
Integration Tests (GPU)	✅ success
Check Markdown Links	✅ success
Helm Blueprint Compliance	✅ success

🔴 GPU docker-tests chain (gated via --ci-wait-gpu): ✅ Integration Tests (arc-runners-org-nvidia-ai-bp-2-gpu) — success

Not addressed in this MR

• BDSA-2026-15147 (vitest) — npm dev dependency; no upstream fix available at time of scan; update vitest when fix is released
• CVE-2025-6984 (langchain-community XXE) — no upstream fix in langchain-community 0.4.1; monitor for release
• Container image OS-level CVEs (CVE-2026-6100, CVE-2026-7210) — Python stdlib use-after-free on base images; exceptions EXC-VI9G-363S and EXC-PLHM-395B in place; re-run with --include-base-image when exceptions expire
• Frontend container CVEs (5 Critical, 38 High) — container surface only; not in --severity crit,high source scope; address in frontend image update cycle

Audit trail

The full per-CVE analysis, expert-review verdicts (R1–R5 all PASS), and Phase 5 validation logs live in the agentic workspace:

cve-fix-reports/NSPECT-S62Q-PZUD-20260709-000000/
  ├── _summary.md
  └── NSPECT-UV6I-R3V9/
      └── aiohttp-CVE-2026-50269-fixed.md  (+ per-CVE files)

This directory is not committed to the repository. Reviewers who need it can request the snapshot from the operator.

---

Refs: NSPECT-S62Q-PZUD
Generated by: agentic-cve-fix

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[nv-rag-cve-bot]

Pipeline validation complete — all gating jobs green.

Run: https://github.com/NVIDIA-AI-Blueprints/rag/actions/runs/28990304904

Job	Result
lint	✅ success
Unit Tests	✅ success
Frontend Unit Tests	✅ success
Integration Tests (GPU — arc-runners-org-nvidia-ai-bp-2-gpu)	✅ success
Check Markdown Links	✅ success
Helm Blueprint Compliance	✅ success

Re-scan (pip-audit): 0 findings. Fix-loop iterations used: 0 of 3.

Generated by: agentic-cve-fix