# D-CROSS-CVE-1 opencv-python pin deferred — gtsam/numpy ABI block

**Recorded**: 2026-05-11T02:55+03:00 (Europe/Kyiv)
**Status**: deferred-non-user (replay when upstream gtsam wheels target numpy>=2)

## What is blocked

Restoring the `opencv-python>=4.12.0` pin in `pyproject.toml` that
D-CROSS-CVE-1 originally mandated.

## Why

* `gtsam==4.2` is the only `gtsam` wheel published on PyPI and it is
  built against the numpy 1.x C ABI. Importing or constructing
  `gtsam.Pose3(...)` under numpy 2.x SEGFAULTs.
* `opencv-python>=4.12` runtime-imports require `numpy>=2`.
* Therefore: keeping `numpy>=1.26,<2.0` (project pin, AZ-263) AND
  `opencv-python>=4.12` makes the project uninstallable as a working set
  — the latest opencv-python that supports numpy 1.x is **4.11.0.86**
  (released 2025-01-16).
* User decision (Batch 5 of `/autodev`, 2026-05-11): keep numpy at 1.26,
  loosen opencv to `>=4.11.0.86,<4.12`. CVE gate is recorded here as a
  follow-up.

## Payload (to be replayed when unblocked)

Change `pyproject.toml`:

```toml
# opencv-python pin restored to D-CROSS-CVE-1 gate
"opencv-python>=4.12.0",
```

Required precondition: a gtsam release (or alternative SE(3) backend)
that publishes numpy-2-compatible wheels.

## CVE exposure window

opencv-python 4.11.0.86 is in the supported 4.x line and receives
security patches as of 2025. The specific CVE(s) D-CROSS-CVE-1 cites
should be re-validated against 4.11.0.86 by the security review team
before this leftover is closed; if any of those CVE fixes shipped in
4.12+ only, document them in this entry and gate the replay on the
gtsam upgrade.

## Replay procedure

1. Confirm a `gtsam` package with numpy-2 wheels is on PyPI **or** swap
   to an alternative SE(3) backend (`pin3py`, custom C++ binding, etc.)
   that supports numpy>=2.
2. Bump `numpy>=2.0,<3.0` and `opencv-python>=4.12.0` simultaneously
   in `pyproject.toml`.
3. Run the full test suite to confirm no other ABI regressions.
4. Delete this leftover.

## Owner

Cross-cutting platform / E-CC-HELPERS team. Until owner is assigned,
autodev steps that touch `pyproject.toml` pins MUST keep the relaxed
opencv pin and reference this file.
