# D-CROSS-CVE-1 opencv-python pin deferred — gtsam/numpy ABI block

**Recorded**: 2026-05-11T02:55+03:00 (Europe/Kyiv)
**Last replay attempt**: 2026-05-29T10:53+03:00 (Europe/Kyiv) — replay re-checked
at start of /autodev cycle-4 Step 10 (Implement). PyPI re-queried via
`python3 -m pip index versions gtsam`: only `gtsam 4.2` is published.
Replay condition (numpy>=2 stable wheels) still NOT met. Leftover remains open.
**Status**: deferred-non-user (replay when upstream gtsam wheels target numpy>=2)

## What is blocked

Restoring the `opencv-python>=4.12.0` pin in `pyproject.toml` that
D-CROSS-CVE-1 originally mandated.

## Why

* `gtsam==4.2` is the only `gtsam` wheel published on PyPI and it is
  built against the numpy 1.x C ABI. Importing or constructing
  `gtsam.Pose3(...)` under numpy 2.x SEGFAULTs.
* `opencv-python>=4.12` runtime-imports require `numpy>=2`.
* Therefore: keeping `numpy>=1.26,<2.0` (project pin, AZ-263) AND
  `opencv-python>=4.12` makes the project uninstallable as a working set
  — the latest opencv-python that supports numpy 1.x is **4.11.0.86**
  (released 2025-01-16).
* User decision (Batch 5 of `/autodev`, 2026-05-11): keep numpy at 1.26,
  loosen opencv to `>=4.11.0.86,<4.12`. CVE gate is recorded here as a
  follow-up.

## Payload (to be replayed when unblocked)

Change `pyproject.toml`:

```toml
# opencv-python pin restored to D-CROSS-CVE-1 gate
"opencv-python>=4.12.0",
```

Required precondition: a gtsam release (or alternative SE(3) backend)
that publishes numpy-2-compatible wheels.

## CVE exposure window

opencv-python 4.11.0.86 is in the supported 4.x line and receives
security patches as of 2025. The specific CVE(s) D-CROSS-CVE-1 cites
should be re-validated against 4.11.0.86 by the security review team
before this leftover is closed; if any of those CVE fixes shipped in
4.12+ only, document them in this entry and gate the replay on the
gtsam upgrade.

**Re-validation result (2026-05-19, greenfield Step 14 Phase 1)**:
`pip-audit` against the `.venv` returned `opencv-python==4.11.0.86`
with `"vulns": []` — neither PyPI's advisory feed nor OSV.dev has a
published advisory tying CVE-2025-53644 to the 4.11.0.86 pin band.
The 4.x-line supported branch appears to have absorbed the relevant
patch in 4.11.0.86. Runtime evidence: NFT-SEC-04 (which feeds
`cve-jpeg-fixture` to every OpenCV imread/imdecode path under
AddressSanitizer) is the executable confirmation in the test suite.
The leftover remains OPEN because the upstream constraint (gtsam
4.2 → numpy<2) has not changed, but the CVE-2025-53644 exposure
window has effectively closed at the current pin. Replay condition
unchanged: numpy-2-compatible gtsam (or alternate SE(3) backend).
See `_docs/05_security/dependency_scan.md` for the full scan output.

**Coupled bump (Phase 1 finding F1)**: when the replay lands, also
bump `cryptography>=46.0.7` in the same change — CVE-2026-39892
re-exposes for Python >3.11, and lifting the gtsam constraint will
also lift the `requires-python = ">=3.10,<3.12"` cap that currently
masks the exposure.

## Replay procedure

1. Confirm a `gtsam` package with numpy-2 wheels is on PyPI **or** swap
   to an alternative SE(3) backend (`pin3py`, custom C++ binding, etc.)
   that supports numpy>=2.
2. Bump `numpy>=2.0,<3.0` and `opencv-python>=4.12.0` simultaneously
   in `pyproject.toml`.
3. Run the full test suite to confirm no other ABI regressions.
4. Delete this leftover.

## Owner

Cross-cutting platform / E-CC-HELPERS team. Until owner is assigned,
autodev steps that touch `pyproject.toml` pins MUST keep the relaxed
opencv pin and reference this file.
