chore(release): v5.1.2 — Security patch (CWE-95 SymPy injection fix) by rahuldass19 · Pull Request #201 · QWED-AI/qwed-verification

Rahul Dass (rahuldass19) · 2026-06-14T11:48:04Z

v5.1.2 — Security Patch Release

This is an emergency patch release. Fixes a High severity (CVSS 8.8) authenticated RCE vulnerability (CWE-95) in SymPy's parse_expr() across all math verification paths.

Security

CWE-95 mitigation: Added safe_parse_expr() with denylist + stripped __builtins__ + allow-listed math namespace + per-call global dict copy + post-parse validation. Replaced all 17 direct parse_expr() call sites.
Calculus symbol consistency: Fixed n symbol mismatch causing incorrect diff/integrate/limit results.
Defense-in-depth: AST depth limits, SymPy tree validation, relational rejection, extra_symbols validation.

Included PRs

#197 fix(ts-sdk): lockfile restore
#198 ci: CodSpeed benchmarks
#199 fix(cache): fail-closed Redis backend
#200 fix(math): restrict SymPy expression parsing (CWE-95)

Version Bumps

Artifact	5.1.1 → 5.1.2
qwed (PyPI)	✅
@qwed-ai/sdk (NPM)	✅
qwed (Rust crate)	✅
API version header	✅
Docker image tag	✅

Summary by CodeRabbit

Security
- Emergency security patch for a critical authentication-based vulnerability.
- Added defense-in-depth hardening: safer expression parsing, consistent symbol handling, stricter validation limits, rejection of unsupported relational expressions, and fail-closed caching behavior.
- Strengthened release notes to document the security improvements in detail.
Chores
- Bumped version to 5.1.2 across APIs, SDKs, Kubernetes deployment image tag, and documentation.

chatgpt-codex-connector · 2026-06-14T11:48:10Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

coderabbitai · 2026-06-14T11:48:16Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 8dbe027c-04f8-4289-893d-889fcf1680e5

📥 Commits

Reviewing files that changed from the base of the PR and between 6eec53b and 818cfd2.

📒 Files selected for processing (8)

CHANGELOG.md
README.md
deploy/kubernetes/deployment.yaml
pyproject.toml
sdk-rust/Cargo.toml
sdk-rust/README.md
sdk-ts/package.json
src/qwed_new/api/main.py

✅ Files skipped from review due to trivial changes (8)

sdk-ts/package.json
deploy/kubernetes/deployment.yaml
sdk-rust/Cargo.toml
sdk-rust/README.md
pyproject.toml
src/qwed_new/api/main.py
CHANGELOG.md
README.md

📝 Walkthrough

Walkthrough

Version is bumped from 5.1.1 to 5.1.2 across all package manifests (pyproject.toml, sdk-rust/Cargo.toml, sdk-ts/package.json), the FastAPI APP_VERSION constant, the Kubernetes deployment image tag, and SDK documentation snippets. CHANGELOG.md and README.md are updated with release notes describing a SymPy parse_expr() RCE security patch.

Changes

v5.1.2 Release Bump

Layer / File(s)	Summary
Changelog and README release notes `CHANGELOG.md`, `README.md`	`CHANGELOG.md` adds an `[Unreleased]` marker and a full `[5.1.2]` entry covering the SymPy `parse_expr()` RCE mitigation, AST/tree validation, Redis fail-closed hardening, and included PRs. `README.md` replaces the v5.1.1 release blurb with matching v5.1.2 security bullet points and updated upgrade guidance.
Version bumps across manifests and runtime constant `pyproject.toml`, `sdk-rust/Cargo.toml`, `sdk-ts/package.json`, `src/qwed_new/api/main.py`, `sdk-rust/README.md`, `deploy/kubernetes/deployment.yaml`	All version references are incremented from `5.1.1` to `5.1.2`: Python project metadata, Rust crate manifest and its README install snippet, TypeScript package, the FastAPI `APP_VERSION` constant (propagates to `/health` and OpenAPI metadata), and the Kubernetes container image tag.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

QWED-AI/qwed-verification#196: Previous release PR that also bumps APP_VERSION in src/qwed_new/api/main.py alongside other changes.
QWED-AI/qwed-verification#156: Earlier release/version bump PR touching the same set of version surfaces (Python package, SDK manifests, Kubernetes image tag).

Poem

🐇 Hop, hop, patch is here!
A tiny bump from one to two,
SymPy's danger now subdued,
Safe parsing saves the day anew.
v5.1.2, secure and true! 🔒

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	❓ Inconclusive	The description comprehensively covers security fixes, symbol consistency, defense-in-depth measures, included PRs, and version bumps. However, the QWED Enforcement Checklist template items are not addressed in the description.	Add explicit sections addressing the QWED Enforcement Checklist (no fallback execution, no raw eval/exec, verification enforcement, fail-closed behavior) to demonstrate compliance with QWED_RULES.md.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main change as a security patch release (v5.1.2) addressing a CWE-95 SymPy injection vulnerability, which aligns directly with the primary objective.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch release/v5.1.2

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

socket-security · 2026-06-14T11:49:08Z

No dependency changes detected. Learn more about Socket for GitHub.

👍 No dependency changes detected in pull request

codspeed-hq · 2026-06-14T11:49:38Z

Merging this PR will not alter performance

✅ 20 untouched benchmarks

_{Comparing release/v5.1.2 (818cfd2) with main (6066b68)}

codecov · 2026-06-14T11:50:25Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@README.md`:
- Around line 63-72: The security label in the Release Update section uses the
imprecise term "CVE-requested" which creates inconsistency with the CVSS 8.8
severity rating referenced in CHANGELOG.md. Replace or clarify the
"CVE-requested" text in the parentheses after "High severity" to use either a
specific CVE identifier (if one has been assigned) or align the wording with the
CVSS severity metric already documented elsewhere. Ensure the release note
maintains consistent security terminology throughout.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 470aff95-fee7-401f-90de-a36f5b4109fe

📥 Commits

Reviewing files that changed from the base of the PR and between 6066b68 and 6eec53b.

⛔ Files ignored due to path filters (1)

sdk-ts/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (8)

CHANGELOG.md
README.md
deploy/kubernetes/deployment.yaml
pyproject.toml
sdk-rust/Cargo.toml
sdk-rust/README.md
sdk-ts/package.json
src/qwed_new/api/main.py

greptile-apps · 2026-06-14T11:54:32Z

Greptile Summary

This is the v5.1.2 release PR, bumping version strings across all eight artefacts (PyPI, NPM, Rust crate, Docker image, API header, docs) after the CWE-95 security fix was already merged in PR #200. The diff itself only touches version identifiers; the substantive safe_parse_expr wrapper and the replacement of all direct parse_expr call sites landed in prior commits.

Version consistency: All eight files are aligned at 5.1.2 — pyproject.toml, sdk-ts/package.json, sdk-rust/Cargo.toml, deploy/kubernetes/deployment.yaml, APP_VERSION in main.py, CHANGELOG, and both READMEs.
Security fix (already merged): safe_parser.py wraps parse_expr with a denylist, stripped __builtins__, allow-listed math namespace, AST/SymPy depth limits, and post-parse type enforcement; all call sites in main.py, verifier.py, batch.py, and validator.py use it.
Minor gap: The wrap_error docstring in exceptions.py still shows bare sympy.parse_expr() as its usage example, which is stale after the security migration.

Confidence Score: 5/5

Safe to merge — the diff is version-string-only, and the underlying security fix was validated and merged before this release PR was opened.

Every changed line in this PR is a version identifier (5.1.1 → 5.1.2). The safe_parse_expr implementation and all call-site replacements are in the base branch and are not touched here. The only stale artefact is a docstring example in exceptions.py that was outside this PR's diff entirely.

No files in the diff require special attention; src/qwed_new/core/exceptions.py (outside the diff) has a stale docstring example worth updating in a follow-up.

Important Files Changed

Filename	Overview
src/qwed_new/api/main.py	Only the APP_VERSION string is updated (5.1.1 → 5.1.2); the safe_parse_expr integration at lines 460–504 was already merged via PR #200 and is unchanged here.
pyproject.toml	Version bumped from 5.1.1 to 5.1.2; no other changes.
sdk-ts/package.json	Package version bumped from 5.1.1 to 5.1.2; no other changes.
sdk-rust/Cargo.toml	Crate version bumped from 5.1.1 to 5.1.2; no other changes.
deploy/kubernetes/deployment.yaml	Docker image tag updated from qwed-verification:5.1.1 to qwed-verification:5.1.2; no other changes.
CHANGELOG.md	New 5.1.2 entry documents the CWE-95 fix; the claim that all 17 parse_expr call sites were replaced is slightly undercut by a stale docstring example in exceptions.py that still shows the unsafe pattern.
README.md	Release notes section updated to describe v5.1.2 security patch; no code changes.
sdk-rust/README.md	Cargo.toml dependency example updated to reference qwed 5.1.2; no other changes.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[User expression string] --> B{Type and length check}
    B -- fail --> ERR[SafeParserError]
    B -- pass --> C{Denylist regex scan}
    C -- match --> ERR
    C -- no match --> D{AST depth check max 30}
    D -- exceeds --> ERR
    D -- pass --> E[Build safe local_dict]
    E --> F[Copy global_dict with empty builtins]
    F --> G[sympy parse_expr]
    G --> H{Post-parse validation}
    H -- fail --> ERR
    H -- pass --> OK[Return SymPy expression]

_{Reviews (2): Last reviewed commit: "chore(release): bump version to 5.1.2" | Re-trigger Greptile}

- Bump core APP_VERSION, pyproject.toml, sdk-ts/package.json, sdk-rust/Cargo.toml, sdk-rust/README.md, k8s deployment image tag - Add CHANGELOG entry for v5.1.2 (CWE-95, CVSS 8.8) - Update README release section

sonarqubecloud · 2026-06-14T11:58:43Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

coderabbitai Bot reviewed Jun 14, 2026

View reviewed changes

Comment thread README.md

chore(release): bump version to 5.1.2

818cfd2

- Bump core APP_VERSION, pyproject.toml, sdk-ts/package.json, sdk-rust/Cargo.toml, sdk-rust/README.md, k8s deployment image tag - Add CHANGELOG entry for v5.1.2 (CWE-95, CVSS 8.8) - Update README release section

Rahul Dass (rahuldass19) force-pushed the release/v5.1.2 branch from 6eec53b to 818cfd2 Compare June 14, 2026 11:56

Rahul Dass (rahuldass19) merged commit 7be2dc6 into main Jun 14, 2026
41 checks passed

coderabbitai Bot mentioned this pull request Jun 19, 2026

release: v5.2.0 — Structured Verification Diagnostics #207

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(release): v5.1.2 — Security patch (CWE-95 SymPy injection fix)#201

chore(release): v5.1.2 — Security patch (CWE-95 SymPy injection fix)#201
Rahul Dass (rahuldass19) merged 1 commit into
mainfrom
release/v5.1.2

Rahul Dass (rahuldass19) commented Jun 14, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

chatgpt-codex-connector Bot commented Jun 14, 2026

Uh oh!

coderabbitai Bot commented Jun 14, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Poem

❌ Failed checks (1 inconclusive)

Uh oh!

socket-security Bot commented Jun 14, 2026 •

edited

Loading

Uh oh!

codspeed-hq Bot commented Jun 14, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Jun 14, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

greptile-apps Bot commented Jun 14, 2026 •

edited

Loading

Uh oh!

sonarqubecloud Bot commented Jun 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

Rahul Dass (rahuldass19) commented Jun 14, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v5.1.2 — Security Patch Release

Security

Included PRs

Version Bumps

Summary by CodeRabbit

Uh oh!

chatgpt-codex-connector Bot commented Jun 14, 2026

Uh oh!

coderabbitai Bot commented Jun 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Poem

❌ Failed checks (1 inconclusive)

Uh oh!

socket-security Bot commented Jun 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codspeed-hq Bot commented Jun 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Uh oh!

codecov Bot commented Jun 14, 2026

Codecov Report

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

greptile-apps Bot commented Jun 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Flowchart

Uh oh!

sonarqubecloud Bot commented Jun 14, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Rahul Dass (rahuldass19) commented Jun 14, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 14, 2026 •

edited

Loading

socket-security Bot commented Jun 14, 2026 •

edited

Loading

codspeed-hq Bot commented Jun 14, 2026 •

edited

Loading

greptile-apps Bot commented Jun 14, 2026 •

edited

Loading