Possible fix(deps): 39 vulnerable dependencies in uv.lock

[begininvoke]

I think there may be a problem in sandboxes/RAG_local/uv.lock around line 1.

CRITICAL — Pre-authentication Remote Code Execution (CVE-2026-45829). The lockfile sandboxes/RAG_local/uv.lock pins chromadb==1.3.5, which falls in the vulnerable range (every release >= 1.0.0 is affected and no fixed version has been published yet). An unauthenticated attacker with network access to the Chroma HTTP server can call POST /api/v2/tenants/{tenant}/databases/{db}/collections supplying a malicious model repository with trust_remote_code=true, causing arbitrary code execution as the server process. Impact: full server compromise, exfiltration of all embedded documents/metadata and any credentials reachable by the process, and lateral movement into the RAG sandbox environment. Risk level: CRITICAL — unauthenticated, trivially exploitable RCE with no vendor patch currently available. Recommended remediation: pin chromadb to the last 0.x release (< 1.0.0) and regenerate the lockfile; if the downgrade is not feasible, isolate the Chroma server (no public ingress), enable Chroma's native token auth middleware, and reject any client-supplied trust_remote_code=true configuration at the application boundary.

Something like this might fix it:

--- a/sandboxes/RAG_local/pyproject.toml
+++ b/sandboxes/RAG_local/pyproject.toml
@@
 dependencies = [
-    "chromadb>=1.3.5",
+    # CVE-2026-45829 (CRITICAL, pre-auth RCE): all chromadb >= 1.0.0 are
+    # vulnerable and no fixed version exists yet. Pin to the last 0.x build
+    # until a patched release is available.
+    "chromadb==0.6.3",
 ]

# Regenerate the lockfile so uv.lock drops the vulnerable 1.3.5 resolution:
# $ cd sandboxes/RAG_local && uv lock && uv sync
# $ grep -A1 'name = "chromadb"' uv.lock   # must now report version = "0.6.3"

# --- Defense-in-depth (required if you must stay on 1.x) ---
# 1) Reject client-controlled trust_remote_code at the API boundary:
#
#    # app/config_guard.py
#    def reject_trust_remote_code(collection_cfg: dict) -> None:
#        """Mitigation for CVE-2026-45829: never honor trust_remote_code=True."""
#        if collection_cfg.get("trust_remote_code") is True:
#            raise PermissionError("trust_remote_code is disabled (CVE-2026-45829)")
#
# 2) Never expose the Chroma server without auth; bind to a private interface:
#    $ chroma run --path ./chroma_data --host 127.0.0.1 --port 8000
#
# 3) Enable Chroma native auth middleware so the endpoint is no longer pre-auth:
#    chroma_client = chromadb.HttpClient(
#        host="127.0.0.1", port=8000,
#        headers={"Authorization": f"Bearer {CHROMA_API_TOKEN}"},
#    )

For reference: rule CVE-2026-45829. Rated critical.

If I have misread how this is used, sorry for the noise — feel free to close.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.