permit 3.0.0: fix dependency CVEs, fix major SDK bugs, gate PRs and releases on CVE scans by zeevmoney · Pull Request #126 · permitio/permit-python

zeevmoney · 2026-09-21T14:20:10Z

Linear issues

Fixes PER-16176: dependency CVEs and CVE gates
Fixes PER-16174: nine major correctness bugs
Fixes PER-16231: typed public surface and py.typed
Fixes PER-11984: authorized_users() under pydantic 2
Fixes PER-12225: support for external type checkers
Fixes PER-15773: the community py.typed contribution, shipped here with the typing fixes
Fixes PER-14375: audit-log models reject logs without a pdp_config_id
Fixes PER-12884: sync/async client parity test
Fixes PER-16333: an offline regression test for every bug class the end-to-end checks detect
Fixes PER-16334: weekly schema-drift check against the public API schema
Part of PER-16177: test-suite gaps (only the skipped ABAC decision tests remain)
Related to PER-16172: the dependency advisories fixed here
Related to PER-15706: the misleading PDP 403 error fixed here
Related to PER-15190: the misleading PDP 403 error fixed here
Follow-ups: PER-16209, PER-16236

GitHub issues

Closes #116
Closes #122
Closes #124

Supersedes the community PRs #123 and #125. Their changes are included here, and each author is credited with a Co-authored-by trailer.

Why

This started as a CVE fix and became the 3.0.0 release.

CVEs. permitio/permit-python had no dependency scanning and no gate on PRs or releases. The resolved dependency tree was clean. All the exposure was in the floors: the package publishes open >= ranges with no lockfile, so aiohttp>=3.12.14 legitimately resolves to 3.12.14 and a consumer inherits every CVE fixed since. That was 34 advisories across aiohttp, h11, anyio and pydantic. A scanner pointed at what CI installs reports all green.

Correctness. Nine major bugs turned up along the way (PER-16174). Among them: context-dependent ABAC checks evaluated against an empty context, authorized_users() could not return under pydantic v2, and the sync client's deprecated facade raised before issuing any request. They survived because 8 of the e2e tests had been @pytest.mark.xfail for about two years. Since the Python floor already had to move (below), this ships as a major version that fixes them properly.

Open backlog. Every open issue and community PR was triaged against this release. The real, still-present ones are fixed here:

Python 3.14: import permit crashed on 3.14 with the pydantic versions the old ranges allowed.
Authorization: bearer: the SDK sent a lowercase scheme; it now sends the standard Bearer.
Typing: the package was untyped, so type checkers skipped it. The one-line py.typed marker a contributor proposed is shipped here together with the typing fixes that make it safe; on its own it would have produced false errors on valid code.

The other open items are already fixed or superseded. They will be closed with an explanation once this ships.

Open SDK tickets. The ones that were still real are fixed here too: audit-log models that rejected logs without a pdp_config_id, nothing guarding the sync client against drifting from the async one, and SDK surfaces with no tests (resource actions, action groups and the deprecated facade).

4.0 deprecations. 3.0.0 starts warning about the two things 4.0 removes: pydantic 1 support and the flat methods on permit.api. See Deprecations.

Breaking changes

All of these need a line in the release notes.

Compatibility

Python 3.8 and 3.9 dropped (python_requires>=3.10). This can't be avoided: aiohttp 3.14.3 is the only release that fixes CVE-2026-69244, and it requires 3.10. 3.8 was already unsupported in practice, since the old aiohttp floor needed 3.9. A 3.9 user who runs pip install -U permit gets Requires-Python >=3.10, and pip quietly keeps the old, vulnerable version.
httpx is no longer installed transitively, and neither are h11, httpcore, anyio or zipp. The SDK never imported httpx. Anyone who relied on permit pulling it in must now declare it themselves.
Higher dependency floors. These old floors no longer install or import cleanly on the Pythons the SDK supports, so they rise:
- pydantic: >=1.10.18,<2 or >=2.4.2 on Python 3.10–3.12; >=1.10.18,<2 or >=2.8.0 on 3.13; >=1.10.25,<2 or >=2.13 on 3.14.
  - 1.10.18 is the first 1.10.x without about 2,400 import-time DeprecationWarnings on 3.13; it also ships the pydantic.v1 package the type hints need.
  - pydantic 2.0–2.4.1 are excluded on every Python. Under pydantic 2 the SDK validates emails with the pydantic.v1 copy that pydantic bundles, and only 2.4.2 and later bundle one fixed for CVE-2024-3772 (1.10.13). pydantic 2.0 exactly also fails every parsed response: its pydantic.v1.parse_obj_as rejects __root__ models.
  - On 3.13, 2.4.2–2.7.x are excluded because they pin a pydantic-core with no Python 3.13 wheels; 2.8.0 (pydantic-core 2.20.0) is the first that has them.
  - On 3.14, earlier releases crash on import permit ("unable to infer type for attribute").
- typing-extensions: >=4.14.0. Releases before 4.6 break import permit on 3.12+, releases before 4.12 break it on 3.13+, and 4.12–4.13 lose TypedDict keys on 3.14.
- loguru: >=0.7.3. Earlier releases warn on 3.14 about an asyncio API that Python 3.16 removes.
permit is now a typed package (PEP 561 py.typed). Type checkers used to skip permit with import-untyped; now they check calls into it.
- Consumers can drop ignore_missing_imports or # type: ignore[import-untyped] for permit, but genuine type errors in their code may now surface.
- SDK models are typed as the pydantic v1 models they have always been at runtime, on both pydantic majors. So v2-only calls such as .model_dump() on an SDK model now fail type checking; they already failed at runtime.
- mypy users on pydantic 2 who want plugin checking of SDK models should use the pydantic.v1.mypy plugin; no plugin is needed.

API

resource_relations.list() now returns PaginatedResultRelationRead, so callers read .data.

This is a bug fix. This method could not work before it. The SDK declared the return type as List[RelationRead], but the API returns a paginated {"data": [...], ...} envelope. So every call raised ValidationError: value is not a valid list before returning anything. No working code can depend on the old return type. The only visible change is the type: callers now read .data.
permit.sync.Permit.authorized_users(), get_user_permissions() and filter_objects() are now synchronous. Callers should drop the await.

This is a bug fix. These methods could not work before it. Only the sync client is affected; the async permit.Permit still awaits them. The sync client inherited all three unchanged from the async class, so they stayed async def, while the sync enforcer under them is already synchronous. Calling one without await returned a coroutine object instead of a result. Awaiting it raised RuntimeError: This event loop is already running. So no working code can depend on the old behaviour. The only visible change is the signature, from async def to def. They now behave like check() and bulk_check(), which were already synchronous on the sync client.
Removed public symbols:
- ContextStore.register_transform(), ContextStore.transform() and ContextTransform. A registered transform was never applied, so these did nothing.
- ApiKeyLevel, a deprecated alias of ApiKeyAccessLevel.
- LoginAsErrorMessages, OpaResult and the JWT alias. None of them had a caller.
Audit-log models accept what the API returns. pdp_config_id on AuditLogModel and DetailedAuditLogModel is now Optional[UUID], and DetailedAuditLogModel.objects is optional. Engine.GENERIC and GenericEngineDecisionLog are new.

This is a bug fix. The API returns logs without a pdp_config_id, and logs from the GENERIC engine; the old models rejected both with a ValidationError. The type change is visible only to code that type-checks pdp_config_id as a plain UUID. No SDK method returns these models.
Relationship-tuple and API-key models accept what the API returns. object_id on RelationshipTupleRead and RelationshipTupleDetailedRead is now Optional[UUID], and RelationshipTupleDetailedRead's subject_details, relation_details, object_details and tenant_details are now optional. APIKeyOwnerType gains nats_pdp_config.

This is a bug fix. relationship_tuples.list() and create() raised ValidationError on a tuple whose object_id is null or absent, which the API schema documents as a tuple on every resource of the object's type. environments.get_api_key() raised on a key owned by nats_pdp_config. Code that reads these attributes may now need a None check, and type checkers will ask for one.

Wire behaviour (same API, different bytes). Each change was checked against the API's request definitions:

An explicitly-set None is now sent as null, so an update can clear a field. Before, exclude_none dropped it: users.update(key, UserUpdate(email=None)) sent {} and quietly did nothing. Fields you never set are still omitted.
users.assign_role / unassign_role omit unset fields, matching role_assignments.assign. The API treats an omitted field and null the same for these fields.
elements.login_as sends canonical hyphenated UUIDs instead of 32-character hex. The API accepts both spellings and resolves them to the same record.
A 3xx response now raises instead of being treated as success. No 3xx is reachable on any path the SDK calls, and aiohttp follows redirects anyway.
Every Authorization header uses Bearer, not bearer. The scheme is case-insensitive (RFC 7235), so nothing breaks; it is listed because the bytes on the wire change.
The deprecated permit.api.assign_role() and unassign_role() forward to permit.api.users.assign_role() and unassign_role(), so they send the request those methods send (/users/{user}/roles) instead of /role_assignments. Both have the same effect.

Kept on purpose: PermitConnectionError still inherits from the deprecated PermitException. Moving it under PermitError would silently stop except PermitException from catching connection failures.

Deprecations (removed in 4.0)

Both still work in 3.x and warn with a DeprecationWarning that says what to use instead:

pydantic 1 support. On pydantic 1, import permit warns once: "Support for pydantic 1 is deprecated and will be removed in permit 4.0. Upgrade to pydantic 2."
The 21 flat methods on permit.api, such as permit.api.get_user(). Each warns with its replacement: "permit.api.get_user() is deprecated and will be removed in permit 4.0; use permit.api.users.get() instead."

Both clients issue the warning at the line that made the call, so Python shows it by default in a script (__main__), and -W error raises it before any request is sent. The blocking client records the calling line before it runs the coroutine, since asyncio's frames would otherwise hide the caller.

The README's new "Deprecations" section lists both and explains how to show or silence the warnings. A project that runs its tests with warnings as errors on pydantic 1 fails on import permit until it adds the filter ignore:Support for pydantic 1:DeprecationWarning.

What changed

Dependency CVE fixes

Package	Before	After	Why
`aiohttp`	`>=3.12.14,<4`	`>=3.14.3,<4`	Clears 32 advisories, including CVE-2026-69244: an out-of-bounds heap read in the HTTP response parser, which a client hits on every call
`pydantic`	`>=1.10.7`	`>=1.10.18,<2` or `>=2.4.2` (Python 3.10–3.12); `>=1.10.18,<2` or `>=2.8.0` (3.13); `>=1.10.25,<2` or `>=2.13` (3.14)	CVE-2024-3772 (EmailStr ReDoS) needs `pydantic.v1` 1.10.13: pydantic 1.10.13+, or pydantic 2.4.2+ whose bundled v1 is fixed; the higher floors are compatibility fixes (breaking change 3). Dual v1/v2 support is kept
`typing-extensions`	`>=4.5.0,<5`	`>=4.14.0,<5`	Compatibility: older releases break `import permit` on 3.12+ (breaking change 3)
`loguru`	`>=0.7.0,<1`	`>=0.7.3,<1`	Compatibility: older releases warn on 3.14 (breaking change 3)
`httpx`	`>=0.24.1,<1`	removed	Never imported. It was the only path by which `h11` (CVE-2025-43859, CRITICAL) and `anyio` (CVE-2026-63374, CRITICAL) got into the tree
`zipp`	`>=3.19.1`	removed	Unused
`werkzeug` (dev)	`>=2.3.8`	`>=3.1.6`	Clears six advisories
`pytest` (dev)	unpinned	`>=9.0.3`	CVE-2025-71176. Caught by this PR's own gate
`aioresponses`, `pytest-mock`, `pytest-cov` (dev)	declared	removed	No test used them. `aioresponses` 0.7.9 is also incompatible with aiohttp 3.14.3

Every dev dependency now has a floor. Without one, a scanner has nothing to evaluate.

Major bug fixes (PER-16174)

Sync client. SyncClass now wraps each method exactly once, however deep the inheritance goes; the facade methods had been wrapped twice, so they raised before sending anything. It detects coroutines with inspect.iscoroutinefunction, unwrapping validate_arguments first. permit.sync.Permit overrides the three enforcement methods it was missing.
Enforcement.
- parse_obj_as is imported through the same v1/v2 guard the rest of the package uses.
- bulk_check honours a per-check context, and filter_objects passes the caller's context through.
- CheckQuery.context is NotRequired, so type checkers accept a bulk_check query without a context, as the runtime always has.
- UserInput accepts snake_case, so first_name/last_name are no longer silently dropped from every check.
Serialization. dict and list request bodies now go through the encoder, so a nested datetime/UUID/Enum no longer crashes inside aiohttp. exclude_none is gone.
Facts proxy. Tenant bulk operations no longer post to the PDP's users endpoint.
PDP error reporting. The PDP sends auth rejections as plain text. Parsing them as JSON raised an exception that the connectivity handler caught, so a 403 caused by a wrong API key was reported as "cannot connect to the PDP container". The error now shows the real status code and response body.

Python 3.14 support

Declared (Programming Language :: Python :: 3.14) and tested. The dependency floors above keep resolvers from picking versions that crash on 3.14.
permit/utils/deprecation.py uses inspect.iscoroutinefunction instead of the asyncio one, which 3.16 removes. This removes 21 import-time warnings on 3.14.
The pydantic version parser accepts pre-releases such as 2.14.0b2. They used to crash import permit with a ValueError.
A new compatibility CI job runs the offline suite on Python 3.10–3.14 against the lowest allowed dependency versions (uv pip compile --resolution lowest-direct), the lowest allowed pydantic 2 (lowest-direct with a pydantic>=2 constraint) and the newest, plus 3.14 on pydantic 1. uv is pinned to 0.12.18. It is not a required check, so the existing required pytest contexts are unchanged.

Typed public surface

Type checkers see the SDK models as the pydantic v1 models that run: each version-conditional import gains an if TYPE_CHECKING: branch, and mypy uses the pydantic.v1.mypy plugin.
Generated model defaults are keyword arguments (Field(default=...)), so optional fields no longer read as required to pyright and Pylance. generate-models passes --use-default-kwarg.
API methods that accept dicts at runtime accept them in their annotations. ModelInput/ModelListInput widen the type for type checkers only; at runtime the parameter is still the model, so an invalid dict still fails validation before any request is sent.
The sync client is typed as synchronous through a generated stub, permit/_sync_types.pyi, built by scripts/generate_sync_stubs.py (make generate-sync-stubs). A test fails if the stub drifts from the async classes.
Smaller typing fixes so a consumer type-checks clean under mypy --strict and pyright:
- plain str is accepted for EmailStr fields;
- UserInput accepts both field spellings;
- explicit re-exports in permit/__init__.py;
- deprecated() keeps the decorated signature;
- PermitConfig() without a token is now a type error, as it already was at runtime.
permit/py.typed and the stub ship in the wheel and sdist, and both the release build and one compatibility leg assert that they do. The README has a short "Type checking" section.
Runtime behaviour is unchanged. A snapshot of every public name, signature, @validate_arguments model and model field (defaults and aliases included) matches the previous commit on both pydantic majors and on Python 3.11 and 3.14.

Audit-log models (PER-14375)

Only the audit-log classes in permit/api/models.py changed. They now match what the pinned generator (datamodel-code-generator 0.33.0) emits from the current public API schema. The rest of the file is unchanged; a full regeneration belongs to PER-16236.
tests/test_fix_audit_logs.py parses logs with pdp_config_id null or missing, detailed logs without objects, and GENERIC-engine logs.

Relationship-tuple and API-key models (PER-16334)

The schema-drift check below found them. APIKeyOwnerType, RelationshipTupleRead and RelationshipTupleDetailedRead now match what the pinned generator emits from the current public API schema; the rest of permit/api/models.py is unchanged.
tests/test_fix_read_models.py parses a wildcard tuple (object_id null and absent) through relationship_tuples.list() and create(), detailed tuples with and without detail blocks, and an API key owned by nats_pdp_config.

Minor bug fixes

every client now sends Authorization: Bearer (was bearer), checked on the wire by an offline test · resource_instances.list(detailed_key=True) always raised · users.sync() mutated the caller's dict and removed the key field the API requires, so that path always returned 422 · SyncPDPApi never called super().__init__ · pdp_timeout was silently ignored by every permit.pdp_api.* call · a dead access-level branch that could never run was removed · docstrings corrected: resource-instance idents are resource:key or a uuid, never a bare key; a resource role's permissions are bare action keys like read.

Packaging and cleanup

setup.py no longer ships a top-level tests package to consumers. A bare find_packages() put it in their site-packages, where it shadows their own tests module. The published permit==2.8.3 does this today.
Removed: duplicate ClientConfig/pagination_params code in pdp_api, a duplicate _model_dump, and unused TypeVars and helpers.
Repo files: removed .isort.cfg (isort isn't run), a stub uv.lock declaring requires-python >=3.14, and the Makefile publish target, which bypassed the gated release. Fixed the Makefile's .DEFAULT_GOAL, which pointed at a target that didn't exist. Fixed a .gitignore rule that did nothing.
The package author is Permit.io (support@permit.io) instead of an individual. The field is informational and does not affect publishing.
Version bumped to 3.0.0.

CVE gates

Dependency Audit runs Trivy over four resolved trees: runtime ceiling, runtime floor, runtime floor with pydantic held to 2, and dev.
- A plain lowest-direct floor always lands on pydantic 1, so the third tree is the only scan of the lowest pydantic 2. Trivy treats pydantic 2.4.0 as fixed for CVE-2024-3772 and rates it MEDIUM, below the gate, so the offline test test_pydantic_requirement_allows_no_release_affected_by_cve_2024_3772 is what blocks pydantic 2.0–2.4.1; the tree gives visibility.
- Two Trivy behaviours both pass silently on a scan that never ran, so both are handled explicitly. Trivy only understands == pins and keys on the filename requirements.txt, so the trees are compiled with uv pip compile. It also writes Results: null and exits 0 when it finds nothing to scan, so that case is detected and fails the gate.
- The runtime floor is compiled on its own. When it was compiled together with dev deps, mypy pulled typing-extensions up and hid the version a consumer can actually get.
- Blocks only on HIGH/CRITICAL advisories that have a fix. Advisories without a fix are still reported.
- Posts a sticky PR comment and GitHub annotations (the only channel that reaches fork PRs).
- The audit job is read-only. The comment is posted from a separate job, so PR-authored setup.py code never runs in a job that holds a write token.
Release now runs as build → scan → publish with hard needs: edges, so publish can't run unless the scan passed. The gate covers the runtime trees only.
Weekly cron (Mondays 09:00 UTC) posts the actual findings to Slack: packages, counts and upgrade targets. It warns and skips if SLACK_WEBHOOK_URL isn't set.
pip-audit audits each of the four compiled trees directly (--no-deps --disable-pip), alongside Trivy. It only reports and never blocks, because it gives no severity. If it cannot check a tree, the PR comment, the Slack message and the job summary say so.
Dependabot: weekly, with 7/14-day cooldowns. versioning-strategy: increase is required. With a setup.py present, Dependabot's default widen would never raise a >= floor.

Workflow hardening

zizmor: 48 findings (12 HIGH) down to 0. actionlint is clean.
Every action is pinned to a SHA, and each SHA was checked against the GitHub API.
persist-credentials: false everywhere, least-privilege permissions:, template injection removed, and the release-tag validation now checks the whole string.
Every action runs on Node 24: upload-artifact v7.0.1, download-artifact v8.0.1 and slack-github-action v4.0.0. The pre-commit job runs pre-commit directly, because the latest pre-commit/action release pins a Node 20 cache action.
Every job runs on ubuntu-24.04 instead of ubuntu-latest, which moves to Ubuntu 26 in October.
The audit script tests have their own pytest.ini, so the SDK's pytest settings don't apply to them.
Schema Drift (PER-16334). .github/scripts/check_schema_drift.py generates models from https://api.permit.io/v2/openapi.json with the pinned generator and compares them with permit/api/models.py by structure: classes, fields, types, required or optional, defaults, aliases, Config.extra and enum members.
- Exit 1 means a difference that makes the SDK send what the API rejects, or reject what it returns. A class or optional field the SDK lacks is listed but does not fail.
- Known differences live in .github/scripts/schema_drift_allowlist.json, one reason each (22 today). An entry that no longer matches fails until it is removed.
- Exit 2 means the comparison did not run (download failed after two retries, generator failure, any other error). It is never reported as clean.
- .github/workflows/schema-drift.yml runs weekly, on manual dispatch, and on pull requests that change the models, the script, the allowlist or the workflow. It is not a required check. A scheduled run that does not pass posts counts and a link to Slack; a manual run always posts.
- The required Audit Script Tests job also runs its 45 unit tests, including one that keeps the script's generator flags identical to the Makefile's.
make generate-models pins its generator: datamodel-code-generator 0.33.0, the release that built models.py, with --exclude-newer 2025-09-18T00:00:00Z and Python 3.11, run through uvx, so contributors need uv.
Deleted release.yml. It ran on release: created while python-sdk-publish.yml ran on published, so every release uploaded the same version twice.
The PDP now starts as a CI step instead of a service container. A service container starts before any step runs, so it could only be given PROJECT_API_KEY. The tests authenticate with the per-run environment key, the PDP rejected every decision with a 403, and that is why the RBAC/ReBAC decision tests could never pass.

Test suite

All 8 xfail markers removed. Those tests now run and pass.
The e2e tests are isolated from each other. They used to fight over fixed keys (admin, viewer, a shared urn), assert environment-wide counts, and fail the test when cleanup got a 404. Each test now uses unique keys, asserts only on its own objects, and tolerates "already gone" during teardown.
Rate limiting (HTTP 429) is handled in conftest for the test session only. Requests retry with backoff, honour Retry-After, and add jitter. The xfail markers had been hiding these 429s. The SDK itself doesn't retry: adding hidden retries to a published client would change behaviour callers never asked for.
test_bulk_operations fixed. It expected a role assignment to survive deleting the user who owns it.
httpserver_listen_address lives in conftest.py and binds a free port. Its port used to depend on which test file pytest collected first, and parallel local runs collided.
Sync/async parity (PER-12884). tests/test_fix_sync_parity.py walks permit.Permit and permit.sync.Permit and fails if a sub-API or method exists only on the async client, if something callable there isn't callable on the sync one, or if anything reachable from the sync client is a coroutine function. It replaces a hard-coded list of five names.
New offline coverage: resource_actions and resource_action_groups (async and sync, every method), all 21 deprecated facade methods (request, result and 4.0 warning), and the audit-log models.
e2e marker. Tests that need credentials, the API or a PDP are marked e2e, so pytest -m "not e2e" runs everything else with no setup. The compatibility job selects tests this way instead of by file name.
An invite test's cleanup deletes its resource instance by resource:key instead of leaking it.
Shared offline helpers. tests/utils.py holds the offline PermitConfig and request-capture helpers that the offline test files share.
Offline regression tests (PER-16333), so every bug class the end-to-end checks detect also fails CI without a backend:
- request bodies keep every key and each value's JSON type (bools, ints, whole floats, nulls, unicode) under both pydantic majors, for 8 models including ResourceCreate and RelationshipTupleCreate; users.update sends a field set to None as null;
- with proxy_facts_via_pdp, each single-object write (users.create, tenants.create, resource_instances.create, relationship_tuples.create, role_assignments.assign, users.assign_role) goes to its own PDP /facts/... route;
- users.get keeps each attribute's JSON type and its nulls;
- no SDK module imports the top-level pydantic namespace outside its pydantic 1 branch;
- get_user_permissions unwraps both PDP response shapes; projects.create with an environment key is refused before any request; delete_tenant_user, environments.copy and user_invites.get send the documented request, and an unknown invite raises a 404 PermitApiError.

Architectural changes

No architectural change to the SDK. The release job graph changes:

flowchart TD
  subgraph After["After: publish is unreachable without a passing scan"]
    B2["build: version, sdist and wheel"] --> S2["scan: compile trees, Trivy, gate"]
    S2 --> P2["publish: PyPI"]
  end
  subgraph Before["Before: two workflows raced"]
    R1["release.yml on 'created'"] --> PY1["twine upload"]
    R2["python-sdk-publish.yml on 'published'"] --> PY2["pypi-publish"]
  end

How it was tested

CI: all 26 checks are green:

308 passed, 7 skipped on both required pydantic legs. At the start of this PR it was 45 passed with 8 permanently xfail.
All 16 compatibility legs (Python 3.10–3.14: lowest dependencies, lowest pydantic 2, newest dependencies, plus 3.14 on pydantic 1) are green, with 291 offline tests each.

The 7 skips:

Three cloud-PDP error tests. CI never reaches the cloud PDP, so they skip with a stated reason.
The decision assertions in test_abac_e2e, waiting on PER-16209. The control-plane half of that test still runs.
Three tests of the pydantic 1 deprecation warning that apply only to the other pydantic major.

End-to-end harness (internal) against a local Permit stack with a real permitio/pdp-v2: 58 passed, 0 failed, 0 skipped, with 95 data-integrity round-trips and 0 differences.

Against the API: every wire-affecting change was checked against the API's route and request/response definitions. Every one was safe.

Offline:

291 offline tests (pytest -m "not e2e"), green on pydantic 1.10.26 and 2.13.5, on every Python from 3.10 to 3.14, and on the pydantic 2 floors (2.4.2 on 3.10–3.12, 2.8.0 on 3.13). Checked that they're real: reverting permit/ makes them fail.
A consumer fixture type-checks with mypy --strict as part of the suite, and also passes pyright strict against the installed wheel. Each typing fix was mutation-checked: undoing any one of them makes the fixture fail.
106 tests for the CI scripts: the audit report renderer and the schema-drift check.
The schema-drift check passes against the live API schema, and the Schema Drift check is green on this PR.
24 request bodies are byte-identical across both pydantic majors.

The gate itself: it fails (exit 1) on the old vulnerable floor and passes (exit 0) on the fixed one.

The weekly audit: a manual run of the Security workflow on this branch finished with no warnings; pip-audit checked all four trees and the Slack message was posted.

Manual test plan

Confirm Dependency Audit posts a sticky comment on this PR.
Push a commit setting aiohttp>=3.12.14,<4. The check should go red and the comment should list CVE-2026-69244. Revert it.
Run gh workflow run security.yml --ref <branch> to run the weekly audit on demand; it posts to Slack.
In a scratch project, pip install this branch and run mypy --strict on code that uses permit.Permit and permit.sync.Permit. Expect no errors, and sync calls typed as their results rather than coroutines.
Publish as 3.0.0 (a major release). The release notes need everything in the breaking-changes section above.

Blast radius and isolation

Blast radius:
- consumers on Python 3.8/3.9, or pinned below the new dependency floors;
- consumers who type-check against permit;
- consumers of the API changes above;
- CI for every future PR;
- the release pipeline.
Isolation: isolated.

Follow-ups

Already applied outside the diff: secret scanning with push protection, Dependabot security updates, and Dependency Audit / Audit Script Tests / Workflow Hardening added as required checks on main.

Still open:

PyPI Trusted Publishing. A publisher has to be registered on PyPI before the workflow can switch over.
PER-16209
PER-16177: the ABAC decision tests that still skip.
PER-16236: native pydantic 2 models. Recent FastAPI rejects pydantic.v1 models as request or response bodies.

Scope and size

SDK runtime: ~1,850 lines added, about 630 of them the mechanical keyword-default rewrite of the generated models. The generated 2,351-line permit/_sync_types.pyi comes on top.
SDK tests: ~5,600. CI workflows and scripts: ~2,730. Their tests: ~1,100.
Single responsibility: no. This combines the CVE fixes, the CI gates, the 3.0.0 correctness work and the open SDK tickets. Kept as one PR for speed, then widened to a major version.

🤖 Generated with Claude Code

The resolved dependency tree was clean, but the published `>=` floors let a consumer install versions carrying 34 known advisories. Because this package ships open ranges with no lockfile, the floor is the real exposure -- so the scan covers both the current resolution and the lowest versions the specs permit. Dependency fixes: - aiohttp >=3.14.3 (clears 32 advisories, incl. CVE-2026-69244, an out-of-bounds heap read in the HTTP response parser this client exercises on every call) - pydantic >=1.10.13 (CVE-2024-3772, EmailStr ReDoS; the SDK uses EmailStr) - werkzeug >=3.1.6, pytest >=9.0.3 - drop httpx: never imported, and the only path by which h11 (CVE-2025-43859, CRITICAL) and anyio entered the tree - drop zipp and aioresponses: both unused, and aioresponses 0.7.9 is incompatible with aiohttp 3.14.3 - python_requires >=3.10; the declared >=3.8 was already unachievable Gates: - Trivy over three trees (runtime ceiling, runtime floor, dev), sticky PR comment, blocking on fixable HIGH/CRITICAL only - release split into build -> scan -> publish, so publish is unreachable unless the scan passed - weekly cron posting the findings themselves to Slack, not just a verdict - Dependabot with cooldowns and versioning-strategy: increase - delete release.yml, which raced python-sdk-publish.yml on every release - existing workflows hardened: 48 zizmor findings (12 high) to zero Also fixes 10 minor SDK bugs with 33 offline regression tests. Nine major correctness bugs found along the way are tracked in PER-16174 rather than changed here. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

linear-code · 2026-09-21T14:20:22Z

…endent pytest_httpserver's `httpserver` fixture is session-scoped: the first test that requests it binds the one shared server for the entire run. The address override lived in test_rbac_e2e.py, so it only applied when that module happened to touch the fixture first. Adding tests/test_offline_regressions.py broke that assumption -- it sorts earlier, claimed the session server on a random port, and test_api_timeout and test_pdp_timeout then failed against their hardcoded localhost:9999 with "Cannot connect to host". Moving the fixture to conftest.py makes the address apply session-wide and removes the latent ordering dependency, which any future test using httpserver would otherwise have tripped over too. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…ations" This reverts commit 160f129.

zeevmoney · 2026-09-21T14:31:08Z

Update (2026-09-25): resolved. test_bulk_operations now passes. Commit 1e6b9e6 corrected the test: its expectation was wrong, because deleting a user also deletes that user's role assignments, so the count returns to the original. All CI checks on this PR are green. The rest of this comment is kept as the original record.

The one remaining red check is pre-existing — here is the proof

tests/endpoints/test_bulk_operations.py::test_bulk_operations fails on this branch. I did not want to hand that over as an unexplained red check, so I isolated it rather than assert it.

Experiment: pushed commit 160f129, which reverted only permit/ back to origin/main while keeping the CI and test changes. Reverted in f9b4857.

Result — with the SDK code identical to main, it still fails identically:

FAILED tests/endpoints/test_bulk_operations.py::test_bulk_operations - assert 0 == (0 + 1)
 +  where 0 = len([])

Corroborated independently: the same test also fails against a local Permit backend + PDP stack built during this work — a completely separate control plane from the shared CI project.

Why it fails. The assertion at line 227 expects a role assignment to survive the deletion of the user who owns it:

await permit.api.users.bulk_delete([user.key for user in CREATED_USERS])
assignments = await permit.api.role_assignments.list()
assert len(assignments) == len_assignments_original + 1  # (tenant role)

The surviving +1 is RoleAssignmentCreate(user=USER_A, role=ADMIN, tenant=TENANT_1). Line 218 asserts the same thing after deleting resource instances and passes, so exactly one assignment exists at that point. users.bulk_delete then removes USER_A, and their tenant role goes with them — leaving 0. The test encodes an assumption that a user's role assignment outlives the user, which the backend does not honour. Nothing in this diff touches users.bulk_delete, role_assignments.bulk_assign or role_assignments.list.

Worth fixing separately — either the test's assumption or the cascade behaviour. Not folded into this PR, which is already larger than it should be.

A useful side effect of the same experiment

With permit/ reverted, the new regression tests failed, which is what should happen:

FAILED test_resource_instances_list_sends_detailed_filter_as_query_string
  - TypeError: Invalid variable type: value should be str, int or float, got True of type <class 'bool'>
FAILED test_users_sync_does_not_mutate_the_caller_dict
  - AssertionError: assert {'email': 'not-an-email'} == {'key': 'user...

So the tests genuinely catch the bugs they target rather than passing vacuously.

Two regressions I did introduce, and fixed

Adding tests/test_offline_regressions.py broke test_api_timeout and test_pdp_timeout. pytest_httpserver's httpserver fixture is session-scoped — the first test to request it binds the one shared server — and the address override lived in test_rbac_e2e.py, so it only applied if that module got there first. The new file sorts earlier, claimed the server on a random port, and those two then failed against their hardcoded localhost:9999. Fixed in e5a88c1 by moving the fixture to conftest.py, which also removes the latent ordering dependency any future test would have tripped over. Both now pass (47 passed, up from 45).

get, get_by_key, update and delete all interpolate their argument straight into the path, and the backend validates it with validate_resource_instance_ident(instance_id, allow_uuids=True) -- a bare instance key is rejected with a 422, not accepted. The docstrings said "the key of the resource instance", which sends callers straight into that error. Wording matches what bulk_delete already documented correctly. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Bumps to 3.0.0 and fixes the nine major bugs tracked in PER-16174, so the eight permanently-xfail tests can assert for real. Sync client (permit/utils/sync.py, permit/sync.py): - SyncClass is now idempotent. It was inherited, so a subclass re-wrapped methods its base had already converted, giving async_to_sync(async_to_sync(f)); all 21 deprecated-facade methods raised "a coroutine was expected" before issuing a request. - Coroutine detection uses inspect.iscoroutinefunction and unwraps functools/validate_arguments wrappers, instead of assuming every object whose class is named "function" is async. - permit.sync.Permit now overrides authorized_users, get_user_permissions and filter_objects, which were inherited as `async def` over a synchronous enforcer and returned un-awaitable coroutines. Enforcement (permit/enforcement/): - parse_obj_as is imported through the pydantic v1/v2 guard the rest of the package uses; authorized_users() could not return at all under pydantic v2. - bulk_check honours a per-check context and filter_objects forwards the caller's context. It was silently dropped, so context-dependent ABAC evaluated against {} and could return the wrong subset. - UserInput accepts snake_case as well as the camelCase aliases; first_name and last_name were silently discarded from every check. Serialization (permit/api/base.py): - dict and list bodies go through the encoder, so nested datetime/UUID/Enum no longer dies inside aiohttp. - exclude_none is dropped, so an explicitly-set None is transmitted as null and an update can clear a field. exclude_unset still omits untouched fields. Facts proxy (permit/api/tenants.py): - tenants bulk operations addressed the PDP's users endpoint. tests/endpoints/test_bulk_operations.py asserted that a tenant role assignment outlives the user who owns it; deleting the user removes it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

The un-xfailed tests all run against one shared environment and were fighting each other: fixed keys (admin, viewer on the built-in __tenant resource), a shared resource urn, assertions on global object counts, and teardown that called pytest.fail on a 404 so "already deleted by another test" turned a passing test red. Several also leaked every object they created. Each test now derives its keys from tests/utils.unique_key, asserts against its own objects rather than environment-wide counts, tears down in a finally via handle_cleanup_error, and polls with a bounded retry where it waits for a fact to reach the PDP. Verified by running twice in a row against a deliberately dirty local environment. test.yml starts the PDP as a step rather than a service container. A service container is created before the first step runs, so it could only be given the long-lived PROJECT_API_KEY while the tests authenticate with the per-run scratch environment key. The PDP rejected every decision with a 403, which is why the ReBAC and RBAC decision tests could never pass. That 403 also surfaced as "cannot connect to the PDP container": the enforcer read error bodies with response.json(), and the PDP sends auth rejections as plain text, so ContentTypeError -- an aiohttp.ClientError -- was caught by the connectivity handler and the real status was lost. Error bodies are now read without assuming JSON, and the message names the status and body. tests/test_abac_pdp.py's three cloud-PDP tests now skip with a reason instead of failing: as CI is configured they never reach the cloud PDP. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

The PDP reports 503 on /healthy until its horizon component finishes pulling config and a policy bundle. Waiting for it immediately after docker run made that bootstrap serial with the job; one leg was ready in 29s and the other still was not at 60s. The wait now happens after dependency installation, so the bootstrap overlaps with it, with a 180s ceiling. Changing an ABAC condition set makes the policy generator recompile the environment's rego and redistribute the bundle, which is much slower than the fact sync RBAC uses. test_abac_e2e timed out at 90s against the real cloud PDP; raised to 300s. The poll returns as soon as the rule lands, so a healthy run is no slower. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

setup.py used a bare find_packages(), which ships a TOP-LEVEL `tests` package into every consumer's site-packages where it shadows their own `tests` module. Verified against the published permit==2.8.3, which does exactly that. Now excluded, along with `harness`. permit.pdp_api never passed a timeout to its HTTP client, so the documented pdp_timeout was silently ignored on every permit.pdp_api.* call while the enforcer honoured it. It also duplicated ClientConfig and pagination_params verbatim from permit.api.base; it imports them now. Removed, none of which had a single caller in permit/, tests/ or harness/: set_if_not_none (enforcer), OpaResult and the JWT alias (interfaces), ApiKeyLevel (a self-declared deprecated alias of ApiKeyAccessLevel), LoginAsErrorMessages (never compared against or returned), and three unused TypeVars in the PDP base module. _model_dump was defined identically in both arms of the pydantic version split; hoisted to one definition. Its `mode` parameter stays and stays ignored on purpose -- it absorbs a v2-style argument that pydantic v1's .dict() would reject. Repo cruft: .isort.cfg (isort is not run; ruff's I rules are), uv.lock (a three-line stub declaring requires-python >=3.14, contradicting setup.py), the Makefile publish target (a second release path that bypasses the gated build -> scan -> publish workflow) and a .DEFAULT_GOAL pointing at a help target that did not exist. .gitignore's .DS_Store rule was inert because of an inline comment. Dependencies: dropped pytest-mock (no test uses it) and pytest-cov (coverage is never requested, including in CI). Corrected the werkzeug comment -- it is now a direct test import, not just a pytest_httpserver transitive. Also dropped two references to .trivyignore, which audit-deps.sh deliberately disables with --ignorefile /dev/null, so both were advertising a suppression mechanism that does not work. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

The condition sets and rule this test creates never reach the PDP's policy bundle, so the decision it waits for never becomes true. The PDP says so in the debug.abac payload the SDK already logs: ~90s of no_matching_usersets with "known usersets: ['rules']" (the empty-package placeholder), then one bundle carrying only the condition sets autogenerated by the resource and role creates ten seconds earlier, then nothing for the remaining 300s. The data channel stayed healthy throughout. The pipeline is event-driven with no polling fallback (the default scope is created with poll_updates=False and batching drains rather than waits), so this is a stall, not slowness, and no timeout makes it pass. Skipped rather than xfailed so it reports honestly instead of looking like coverage. Only the three decision assertions are skipped. Everything above them still runs against the real control plane -- condition set and rule create, type round-trip, paginated list, filtered list, permission-format assertion -- and so does the teardown, because pytest.Skipped derives from BaseException and escapes the test's except Exception. Ruled out as causes: resource_id passed as .hex (the generator keys on the resource key, never the id), inline check attributes (they win the object.union_n in the generated rego and the PDP echoed them back), and a missing setup step. No other test is exposed: condition_set_changes.py is the only policy synchronizer handler that generates rego, so RBAC and ReBAC decisions resolve against data.* on the fact channel, and this is the only test that touches condition sets. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

resource_relations.list() declared List[RelationRead], but the route is declared response_model=PaginatedResult[RelationRead], so against current backend main the call raised "ValidationError: value is not a valid list" -- the method was unusable. It now returns PaginatedResultRelationRead; callers read .data. BREAKING, and in the 3.0.0 notes. (That change was written earlier and swept into the previous commit by a bare `git add -A`; this records what it actually is.) Two docstrings corrected against the backend, both of which sent callers into a confusing error: - resource_roles.assign_permissions/remove_permissions said permissions are <resourceKey:actionKey>. A resource role is scoped to its own resource, so each entry is a BARE action key. Passing the qualified form makes the server read the whole string as an action key and reject it with a 404 naming '<resource>:<resource>:<action>' -- a doubled prefix that reads like the SDK concatenated wrongly, when it is the server quoting what it was given. - role_assignments.list(resource_instance_key=...) takes a `resource_type:instance_key` ident or an instance uuid, never a bare key. Regression tests pin the exact wire strings on both pydantic majors. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

Every remaining CI failure was one cause: HTTP 429 on a cleanup call. Enabling the eight previously-xfail tests and giving each its own objects made the suite create and tear down far more than before, and teardown is where the burst lands -- one leg reported 3 failed and 2 teardown errors, the other 7 failed, all of them 429 on a delete. handle_cleanup_error now tolerates 429 alongside 404, for the same reason 404 is tolerated: neither leaves the test's assertions in doubt. A throttled delete leaks an object, and CI deletes the whole scratch environment afterwards, so it is reclaimed. Any other status still fails the test. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

The previous commit tolerated 429 during teardown. That was wrong in a way the next CI run made obvious: a tolerated DELETE leaves the object alive, so the assert-it-is-gone check that follows failed with "DID NOT RAISE PermitApiError". The tolerance manufactured a worse failure than the one it hid. 429 is no longer tolerated. It was also the wrong layer. The run after showed 429 arriving in test BODIES as well -- test_rebac_e2e, test_sync_client and test_user_invites_complete_e2e all failed mid-test -- so cleanup was never the whole problem. The suite runs against one environment on a shared cloud project and now creates and tears down considerably more than it used to, which exceeds the burst limit. The eight tests that were xfail until this branch had been swallowing these 429s all along. conftest wraps the SDK's five HTTP verbs for the test session only, retrying a 429 with exponential backoff so the call actually succeeds. The SDK is untouched: adding implicit retries to a published client would be a behaviour change callers did not ask for. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

Six attempts (~63s of backoff) still ran out on one teardown, leaving CI at 1 failed / 102 passed. Raised to nine, which caps a single call at roughly two minutes of waiting and exits the moment it succeeds. Also honours the server's Retry-After when it sends one, and adds jitter to the exponential fallback so concurrent callers do not retry in lockstep and re-trip the limit together. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

bulk_check() reads each query's context with .get(), so a query without one is valid at run time, but the TypedDict declared the key as required and mypy rejected every bulk_check([{"user", "action", "resource"}]) call. TypedDict comes from typing_extensions so NotRequired is honoured on 3.10. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

The REST API client, the PDP API client and the enforcer sent "bearer <token>". The scheme is case-insensitive per RFC 7235, but "Bearer" is the canonical form every other Permit SDK sends, and at least one server once rejected the lowercase form with a 401. A facade-level offline test now reads the header each client actually puts on the wire. Co-authored-by: Suren <suren@cercli.com> Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

On Python 3.14, pydantic 1.x before 1.10.25 and 2.x before 2.13 crash on import permit ("unable to infer type for attribute"), so the pydantic requirement is split by Python version and excludes those releases there. pydantic 2.0 is excluded everywhere: its pydantic.v1.parse_obj_as rejects the SDK's __root__ models, failing every parsed API response. The typing-extensions and loguru floors could not import on current Pythons (typing-extensions before 4.6 breaks on 3.12+, before 4.12 on 3.13+, 4.12-4.13 lose TypedDict keys on 3.14; loguru before 0.7.3 warns on 3.14), so they rise to 4.14.0 and 0.7.3. deprecation.py uses inspect.iscoroutinefunction instead of the asyncio one 3.16 removes, and the pydantic version parser accepts pre-releases such as 2.14.0b2, which crashed the import. A new compatibility CI job runs the offline suite on Python 3.10-3.14 at both the lowest allowed and the newest dependency versions. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

permit now declares itself typed, and type checkers see what actually runs: the SDK models are typed as the pydantic.v1 models they are on both pydantic majors (TYPE_CHECKING import branches, pydantic.v1.mypy plugin), generated model defaults are keyword arguments so optional fields no longer read as required, API methods that accept dicts at runtime accept them in their annotations (typing-only ModelInput/ModelListInput, runtime validation unchanged), and the sync client is typed as synchronous through a generated stub (permit/_sync_types.pyi, with a drift test). The pre-3.14 pydantic floor rises to 1.10.18: 1.10.17 is the first release with the pydantic.v1 package, and 1.10.13-1.10.17 emit about 2,400 DeprecationWarnings on Python 3.13. A consumer fixture is type-checked with mypy --strict in the test suite on every CI leg, and the release and compatibility builds assert the wheel ships py.typed and the stub. Runtime behaviour is unchanged: a snapshot of every public name, signature, validate_arguments model and model field matches the previous commit on both pydantic majors. Co-authored-by: Tarcio Silva <luan.coc13@gmail.com> Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

Under pydantic 2, permit validates emails with the pydantic.v1 copy that pydantic bundles. That copy is fixed for CVE-2024-3772 (ReDoS in email validation) only from pydantic 2.4.2, which bundles 1.10.13: 2.0.1 bundles 1.10.11, and 2.4.0 and 2.4.1 bundle 1.10.12. Below Python 3.14 the spec still allowed 2.0.1-2.4.1. The pre-3.14 requirement is now two lines. Python 3.10-3.12 allow pydantic 2 from 2.4.2. Python 3.13 allows it from 2.8.0, because 2.4.2-2.7.x pin a pydantic-core with no Python 3.13 wheels. The pydantic 1 floor (1.10.18) and the 3.14 line are unchanged. Nothing resolved the pydantic 2 floor before: lowest-direct over requirements.txt picks pydantic 1, so the floor CI legs and the audit's runtime-floor tree only ever saw 1.10.18, and Trivy treats 2.4.0 as fixed. A pydantic-v2-floor compatibility leg on every Python and a runtime-floor-pydantic-v2 audit tree now resolve lowest-direct with pydantic held to >=2, and every format_audit.py call reads the new tree. Every setup-uv step pins uv 0.12.18, so a uv release cannot change which floor is tested or scanned. The offline tests check, per Python, that no allowed pydantic is affected by the CVE and that each major is allowed from its floor up. Part of PER-16176. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

The comment claimed py.typed and _sync_types.pyi ship only because package_data lists them. setuptools 69 and later include them by default; 68.2.2 does not. The project has no [build-system] table, so a build can still run with an older setuptools, which is what package_data guards against. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

The docstrings in tests/test_fix_permissions.py and tests/test_fix_relations.py now state what the API does: how it reads a role's permission strings, which resource_instance filter values it rejects, and the paginated envelope the relations list returns. They no longer point at server source files. The Dependabot cooldown comment no longer names a policy kept outside this repository. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

PYDANTIC_CANDIDATES is now built by explicit loops instead of a triple-nested comprehension. The list is unchanged (931 entries). audit-deps.sh no longer runs mkdir -p on the output directory before writing the pydantic constraint file: compile_tree has already created it at that point. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

Every job carried a notice that ubuntu-latest moves to Ubuntu 26 from October 19, 2026. Pinning ubuntu-24.04 keeps the image these workflows run on today (ubuntu-latest resolves to ubuntu-24.04 now), so the move becomes a deliberate change here rather than one that arrives unannounced under an unchanged workflow. No step changes: the tools they call (shellcheck, docker, jq, curl) are the ones the current image has. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

The Comment on PR step ran only when hashFiles('/tmp/audit/comment.md') was non-empty. hashFiles ignores every file outside the workspace, so the guard was always false and no audit comment ever reached a PR, including the pip-audit gap notice that is meant to appear there. The step now runs whenever the artifact downloads, and the script checks the report itself. A report that is missing or does not start with the marker means the render step did not finish: the step warns and posts nothing. A report over GitHub's 65,536-character comment limit would be rejected, so the comment then links to the job summary instead. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

audit-deps.sh gave pip-audit a temporary --cache-dir, saying it kept pip-audit away from the runner's pip HTTP cache. pip-audit 2.10.1 never uses pip's cache for its vulnerability lookups: its services build their session with use_pip=False, so without --cache-dir it already uses its own directory, which is empty on a fresh runner. The mktemp, the flag and the cleanup did nothing and the comment explaining them was wrong. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

The Slack line joined the gap labels as they were, so it read "pip-audit did not fully check pip-audit:dev-ceiling, pip-audit:runtime-floor". It now drops the scanner prefix and names the trees alone. The test covers two trees, one of them with two gaps, and checks the whole line. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

The Install Trivy step runs trivy-action only to install Trivy, and the action always scans scan-ref. The repo root has nothing Trivy can scan, so every Dependency Audit and Security Gate run logged "WARN [report] Supported files for scanner(s) not found". hide-progress sets TRIVY_QUIET, which drops that warning along with the INFO lines and the DB progress bar. Fatal errors still print (checked with Trivy 0.70.0, the version the action installs). The step comment also said the step warms Trivy's vulnerability DB for the real scan. It does not: the action sets TRIVY_CACHE_DIR only inside its own step, so audit-deps.sh uses Trivy's default cache and downloads its own DB. The comment now says only what the step does. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

The trigger comment said Dependency Audit was only meant to become a required check and that a red audit did not block a merge. Branch protection on main already requires Dependency Audit, Audit Script Tests and Workflow Hardening, so the comment now says that. It also dropped the "warm Trivy DB" timing, since the audit's scans download their own DB. The Slack guard's comment said the repository had no SLACK_WEBHOOK_URL. The secret is set and the weekly run posts, so the comment now says what the guard is for: a repository or fork without the secret gets a warning rather than a failed job. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

github-actions · 2026-09-24T17:31:47Z

Dependency Security Audit

Scanned: requirements.txt + requirements-dev.txt, resolved at Python 3.10 (the current resolution, and the lowest versions the published specs permit under each pydantic major)

✅ No known vulnerabilities found.

Both the resolved dependency set and the lowest versions the published specs permit are clean at HIGH and CRITICAL.

The package metadata named one person as the author. It now names Permit.io with the public support address, so PyPI shows the company that maintains the SDK. The author field is informational only: publishing is unaffected. The e2e tests used the same person's name and email as sample user data. They now use a fictional user; no assertion depends on the values. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

Five offline test files each built their own PermitConfig for the local mock server, in two shapes, and two of them repeated the same `config` fixture, the Call/call table helpers, the sent() request capture and the test project's paths. A change to how the offline tests configure the SDK had to be made five times. offline_config(), Call, call(), sent() and the FACTS/SCHEMA paths now live in tests/utils.py, next to the existing shared helpers, and the `config` fixture lives in conftest.py. The same 276 tests are collected. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

The deprecated flat methods on permit.api warn from inside their coroutine with stacklevel=2. The async client awaits that coroutine from the caller's code, so its warning names the caller's line. The blocking client runs the coroutine under asyncio.run, sometimes in a worker thread, so the warning named asyncio/events.py instead, and Python's default filters, which show a DeprecationWarning only when it points at __main__, hid it from scripts. async_to_sync now records the line that called the blocking method and passes it to the thread that runs the coroutine, which holds it in a context variable while the coroutine runs. deprecated() warns at that line when it is set, through warnings.warn_explicit with the caller module's name and registry, the values warnings.warn itself uses. The context variable replaces the flag that marked a coroutine as driven by a blocking call, so re-entrant calls behave as before. With no Python caller frame, as for an atexit hook, the warning names <sys> line 0, as warnings.warn does. The async client's warning is unchanged. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

permit/__init__.py imported PYDANTIC_VERSION under its own name to decide whether to warn about pydantic 1, and `from permit.api.models import *` exported it as well, because models.py imported it the same way and defines no __all__. So permit.PYDANTIC_VERSION showed in dir(permit) and `from permit import *` handed it to callers, although it is an internal constant. encoders.py and pdp_api/role_assignments.py read it from there. Both modules now import it as _PYDANTIC_VERSION, the way `import warnings as _warnings` already is, and the two internal readers import it from permit.utils.pydantic_version. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

The blocking client's call-site warning passed the calling module's globals to warnings.warn_explicit. From Python 3.12, warn_explicit then asks the module's loader for the source line. A script's __main__ has a loader but no __spec__, so each call there issued a second DeprecationWarning ("Module globals is missing a __spec__.loader"), and under -W error that one was raised instead of the deprecation. Code run by exec() or runpy.run_path() has neither, so the call raised ValueError. warnings.warn does not pass module globals, so the call-site warning no longer does either, and the two now issue the same single warning. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

Pointing the blocking client's warnings at the caller made call_site a required second argument of run_coroutine_sync, which has taken just the coroutine since 2.x, and added CallSite and blocking_call_site() as public names of permit.utils.sync. None of them was meant as new API. async_to_sync now hands its call site to a private _run_blocking, and run_coroutine_sync(coroutine) keeps its signature: it records the line that called it, so a direct caller still gets the re-entrant path and warnings attributed to that line. The call-site class and context variable are private, and deprecated() reads the context variable directly. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

The blocking client's warning passes the calling module's warning registry to warn_explicit, which is what makes Python's default filters print it once per line, as they do for the async client. No test covered that: the __main__ script called each client once, and replacing the registry with None or a fresh dict passed the whole suite. The script now calls each client three times from the same line and still expects one line each. The no-caller test started a thread from C and recorded its warning with catch_warnings in the main thread. Under context-aware warnings, the default on free-threaded 3.14, that thread never reaches the recorder, and the test did not wait for the thread to finish. It now runs a script whose atexit hook calls the method, the case the code handles, and checks the script's output. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

After regenerating permit/api/models.py, the hand-written import header has to be re-applied, and the Makefile describes it. The header now imports PYDANTIC_VERSION as _PYDANTIC_VERSION, so that permit/__init__.py's star import of the models does not export it; say so where someone regenerating the models reads the steps. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

zeevmoney · 2026-09-25T17:36:43Z

Open issues and PRs this release resolves

Closed automatically when this PR merges (by Closes in the description):

Issue	Resolved by
#116 `mypy`: missing library stubs or `py.typed` marker	`permit` ships `py.typed`, together with the typing fixes that make it safe (see "Typed public surface").
#122 Cloud PDP returns 401 because of lowercase `bearer`	Every `Authorization` header uses `Bearer` (breaking change 13).
#124 pydantic v1 is incompatible with Python 3.14	Python 3.14 is supported on both pydantic majors, with floors that keep resolvers off the releases that crash (see "Python 3.14 support").

Superseded community PRs. Pull requests are not closed by keywords, so these will be closed by hand after 3.0.0 is released:

PR	Why it is superseded
#123 uppercase `Bearer`	The same fix is here, applied to every client. The author is credited with a `Co-authored-by` trailer.
#125 `py.typed` marker	The marker ships here with the typing fixes. On its own it produced false errors on valid code. The author is credited with a `Co-authored-by` trailer.

Replies on the issues and PRs themselves will follow the release.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Some SDK behaviours had no offline test, so a regression in them would only show up against a live API or PDP. These tests pin them with a local pytest_httpserver or a static scan: - request bodies keep every key and every value's JSON type, nulls included, and are identical under both pydantic majors - users.update sends a field set to None as null - no SDK module imports the top-level pydantic namespace outside its pydantic 1 branch - get_user_permissions unwraps both PDP response shapes - projects.create with an environment key is refused before any request - delete_tenant_user, environments.copy and user_invites.get send the request the API schema documents, and an unknown invite raises a 404 PermitApiError Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

Nothing regenerates permit/api/models.py on a schedule, so the public API schema can change without the SDK noticing. A model that still requires a field the API stopped sending, or an enum that lacks a value the API now returns, fails only when a user parses such a response. check_schema_drift.py generates models from the live schema with the pinned generator and the Makefile's flags, and compares them with models.py through the AST: classes, fields, types, required or optional, defaults, aliases, Config.extra and enum members. Changes that make the SDK send what the API rejects, or reject what it returns, fail. A class or optional field the SDK lacks is only reported. Today's differences are allowlisted with a reason each, so only new drift is flagged. The Schema Drift workflow runs it weekly, on dispatch and on PRs that touch these paths. It is not a required check, and a scheduled run that finds drift or cannot run posts counts to Slack. The Audit Script Tests job runs its unit tests. The Makefile now pins the generator that built models.py, and its comment above generate-models documents the check. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

The API schema documents a relationship tuple's object_id as optional (null means every resource of the object's type) and the detailed tuple's subject, relation, object and tenant detail blocks as optional, and lists nats_pdp_config as an API key owner type. models.py required the first two and lacked the third, so relationship_tuples.list() and create() raised ValidationError on a wildcard tuple, and environments.get_api_key() on a NATS PDP key. APIKeyOwnerType, RelationshipTupleRead and RelationshipTupleDetailedRead now match what the pinned generator emits for them from the current schema. The 13 schema drift allowlist entries that recorded these differences are removed, and the live check passes without them. object_id and the four detail attributes are now Optional, so code that reads them may need a None check. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

The offline tests pinned only the bulk PDP routes, so a single-object write sent to the wrong one went unnoticed: pointing tenants, relationship_tuples and role_assignments at /facts/users still passed the whole suite. users.create, tenants.create, resource_instances.create, relationship_tuples.create, role_assignments.assign and users.assign_role now each assert the method, path and body they send with proxy_facts_via_pdp on. The request-body test now builds each model inside the test, so a model that fails to build fails its own case instead of the whole module, and covers ResourceCreate with action and attribute blocks and RelationshipTupleCreate. A new test checks that users.get() keeps each attribute's JSON type (bool, int, whole float, null) under both pydantic majors. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

Only DriftError mapped to exit 2. Any other exception, such as a models file that is not UTF-8 or a download cut short (http.client.IncompleteRead), ended the script with Python's exit 1, which the workflow reads as drift with 0 differences listed. main() now also catches any other exception, prints its traceback to stderr, writes the did-not-run report and returns 2. A failed schema download, including a truncated one, is now retried twice, 5s and then 10s later, before the check gives up with exit 2. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

Neither job had a timeout-minutes, so a hung step could hold a runner for GitHub's six-hour default. The drift job now stops after 20 minutes, which covers the script's three 60s download attempts and 10-minute generator limit, and the notify job after 5. The notify job now also runs on workflow_dispatch, as the Security workflow's does, so the Slack path can be tried on demand. A manual run posts whatever the result, so the message now has a passed variant. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

--exclude-newer 2025-09-18 is a bare date, which uv reads in the local time zone, so the cutoff moved with the machine running it. The Makefile and the drift script now pass 2025-09-18T00:00:00Z, which still resolves datamodel-code-generator 0.33.0 and the same dependencies. The comment above generate-models said an unchanged spec regenerates an unchanged file; the timestamp header changes and some lines in models.py are wider than the generator wraps them, so it now says the same models. It also names the files whose changes trigger the pull request run, says that exit 0 means no new failing drift and no stale entry, and says why deleting a class from models.py is only reported. The drift report now points at the comment above generate-models in the Makefile instead of "the comment above it". Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

zeevmoney and others added 3 commits September 21, 2026 17:25

TEMP: revert permit/ to origin/main to isolate test_bulk_operations

160f129

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Revert "TEMP: revert permit/ to origin/main to isolate test_bulk_oper…

f9b4857

…ations" This reverts commit 160f129.

zeevmoney and others added 11 commits September 22, 2026 12:40

Point the ABAC skip at PER-16209

e33c160

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

zeevmoney changed the title ~~Fix dependency CVEs and add blocking CVE gates on PRs, releases and a weekly scan~~ permit 3.0.0: fix dependency CVEs, fix major SDK bugs, gate PRs and releases on CVE scans Sep 22, 2026

This was referenced Sep 23, 2026

Migrate packaging, dependencies and CI to uv #127

Draft

Adopt strict ruff and mypy, reformat and fix the codebase #128

Draft

zeevmoney and others added 9 commits September 23, 2026 14:41

Reduce the ABAC skip to its ticket reference

1696305

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

Format the ABAC skip

76ed0ab

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6b4ERDYYZ8NRTv1zJYxx2

zeevmoney and others added 6 commits September 24, 2026 19:55

zeevmoney and others added 8 commits September 25, 2026 18:27

zeevmoney marked this pull request as ready for review September 25, 2026 17:40

Copilot AI lite review requested due to automatic review settings September 25, 2026 17:40

Copilot started reviewing on behalf of zeevmoney September 25, 2026 17:41 View session

Copilot AI reviewed Sep 25, 2026

zeevmoney and others added 7 commits September 25, 2026 23:37

Copilot AI review requested due to automatic review settings September 25, 2026 21:26

Copilot started reviewing on behalf of zeevmoney September 25, 2026 21:27 View session

Copilot AI reviewed Sep 25, 2026

Navigation Menu

permit 3.0.0: fix dependency CVEs, fix major SDK bugs, gate PRs and releases on CVE scans - #126

permit 3.0.0: fix dependency CVEs, fix major SDK bugs, gate PRs and releases on CVE scans#126
zeevmoney wants to merge 70 commits into
mainfrom
per-16176/cve-gates-and-fixes

zeevmoney commented Sep 21, 2026 •

edited

Loading

Uh oh!

linear-code Bot commented Sep 21, 2026 •

edited

Loading

Uh oh!

zeevmoney commented Sep 21, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 24, 2026

Uh oh!

zeevmoney commented Sep 25, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

zeevmoney commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Linear issues

GitHub issues

Why

Breaking changes

Deprecations (removed in 4.0)

What changed

Dependency CVE fixes

Major bug fixes (PER-16174)

Python 3.14 support

Typed public surface

Audit-log models (PER-14375)

Relationship-tuple and API-key models (PER-16334)

Minor bug fixes

Packaging and cleanup

CVE gates

Workflow hardening

Test suite

Architectural changes

How it was tested

Manual test plan

Blast radius and isolation

Follow-ups

Scope and size

Uh oh!

linear-code Bot commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zeevmoney commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

The one remaining red check is pre-existing — here is the proof

A useful side effect of the same experiment

Two regressions I did introduce, and fixed

Uh oh!

github-actions Bot commented Sep 24, 2026

Dependency Security Audit

Uh oh!

zeevmoney commented Sep 25, 2026

Open issues and PRs this release resolves

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

zeevmoney commented Sep 21, 2026 •

edited

Loading

linear-code Bot commented Sep 21, 2026 •

edited

Loading

zeevmoney commented Sep 21, 2026 •

edited

Loading