scan_packages: baseline transitive-dep drift in the supply-chain scan

[danielhanchen]

What

The Security audit workflow's pip scan-packages gate runs
scripts/scan_packages.py --with-deps with SCAN_ENFORCE=1, which
downloads the full transitive dependency closure and blocks on any
CRITICAL/HIGH pattern-scan finding that is not in
scripts/scan_packages_baseline.json.

Recent upstream releases of transitive dependencies added new files and
loops that the pattern scanner flags, so all three shards red-failed on
main on legitimate library code:

• pip scan-packages :: extras (4 CRITICAL, 1 HIGH)
• pip scan-packages :: hf-stack (4 CRITICAL)
• pip scan-packages :: studio (6 CRITICAL, 1 HIGH)

This is dependency-baseline drift, not a code change in this repo. The
biggest driver is huggingface_hub 1.22.0 (published 2026-07-03), pulled
in via huggingface_hub>=0.34.0; it ships a new _sandbox.py (HF Jobs
sandbox) plus new while True loops. The remaining ones come from
fastapi, fastmcp-slim and cffi.

Fix

Add the 7 reviewed findings to the baseline. Each was confirmed to be
genuine upstream code from the official PyPI archive, not a typosquat or
injected payload:

package	file	check	why it is benign
huggingface-hub	huggingface_hub/_sandbox.py	Writes to /tmp and executes	HF Jobs sandbox bootstrap script string (_BOOTSTRAP_DOWNLOAD) that fetches HF's own sbx-server
huggingface-hub	huggingface_hub/_sandbox.py	C2 polling loop	host-pool slot reservation while True loop
huggingface-hub	huggingface_hub/hf_api.py	C2 polling loop	standard status-polling loop
huggingface-hub	huggingface_hub/utils/_http.py	C2 polling loop	HTTP retry loop
fastapi	fastapi/routing.py	C2 polling loop	websocket receive loop
fastmcp-slim	fastmcp/cli/apps_dev.py	fs enum + network	FastMCP (PrefectHQ) dev CLI making httpx/socket calls
cffi	cffi/_cffi_gen_src.py	compile + exec	cffi compiling and running generated C-extension source (its core purpose)

The change is additive only: no existing baseline entry is changed or
removed.

Verification

Re-ran scripts/scan_packages.py --with-deps over the full closure of
all shard requirement files on Python 3.12.13 (the CI interpreter). The
while True span digests generated locally match the CI logs exactly
(e.g. _sandbox.py sha256:33ceddf9..., hf_api.py sha256:f764b6ca...,
_http.py sha256:c75d1ee2...), confirming identical resolved versions.
With the updated baseline the scan exits 0: all 140 CRITICAL + 72 HIGH
findings are suppressed and only MEDIUM (non-blocking) findings remain.

Note on the other red check (Core / HF=4.57.6 + TRL<1)

Out of scope for this PR. Its failing step, unsloth_zoo @ main - full pytest (CPU), fails 6 tests in unsloth_zoo's
tests/test_moe_bnb4bit_per_expert_conversions.py with
AttributeError: 'WeightConverter' object has no attribute 'target_patterns'. Root cause is an unsloth_zoo-side interaction, not
the studio merge: that test (added in unsloth_zoo #856) guards with
pytest.importorskip("transformers.core_model_loading"), but unsloth's
import_fixes.py intentionally injects a stub core_model_loading
module on transformers 4.x (to keep peft 0.19 LoRA reloads working), so
the guard does not skip and the test runs against the inert stub. The
identical 6 failures are present on the previous main commit
(eb1ef442), so it predates this PR's HEAD. The correct fix belongs in
unsloth_zoo (guard on the real v5 module, not mere importability), not
in unsloth.

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.

[gemini-code-assist]

Code Review

This pull request updates scripts/scan_packages_baseline.json to add several package scanning baseline exceptions for fastapi, fastmcp-slim, huggingface-hub, and cffi. No review comments were provided, so I have no feedback to offer.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.