Fail closed on Chromium sandbox launch failure

.github/workflows/ci.yml

@@ -730,6 +730,8 @@ jobs:
     needs: [changes, build]
     if: needs.changes.outputs.benchmarks == 'true'
     runs-on: ubuntu-24.04
+    # Browser installation can spend several minutes in apt on a hosted runner;
+    # leave enough room for the benchmark itself after setup completes.
     timeout-minutes: 20
     continue-on-error: true
     strategy:

.github/workflows/security-audit.yml

@@ -0,0 +1,74 @@
+name: Dependency security audit
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/security-audit.yml"
+      - "Cargo.lock"
+      - "**/Cargo.lock"
+      - "**/package-lock.json"
+      - "**/bun.lock"
+      - "**/bun.lockb"
+      - "**/uv.lock"
+      - "**/requirements*.lock"
+      - "**/Pipfile.lock"
+      - "**/poetry.lock"
+      - "**/pdm.lock"
+      - "**/pixi.lock"
+      - "**/pylock*.toml"
+      - "**/yarn.lock"
+      - "**/pnpm-lock.yaml"
+      - "**/npm-shrinkwrap.json"
+      - "**/go.sum"
+      - "**/Gemfile.lock"
+      - "**/composer.lock"
+      - "**/Package.resolved"
+      - "**/Podfile.lock"
+      - "**/packages.lock.json"
+      - "**/flake.lock"
+      - "**/gradle.lockfile"
+      - "pyproject.toml"
+      - "Cargo.toml"
+      - "**/Cargo.toml"
+      - "package.json"
+      - "**/package.json"
+      - "docs/app/pyproject.toml"
+      - "docs/app/reflex.lock/package.json"
+      - "benchmarks/requirements*.in"
+      - "benchmarks/requirements*.txt"
+      - "scripts/verify_dependency_lock_inventory.py"
+      - "scripts/audit_dependencies.py"
+      - "Makefile"
+  schedule:
+    - cron: "17 3 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  audit:
+    name: Audit committed dependency locks
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
+      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        with:
+          enable-cache: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "22"
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: "1.4.2"
+
+      - name: Install Rust advisory scanner
+        run: cargo install cargo-audit --locked
+
+      - name: Audit active dependency locks
+        run: make PYTHON=python3 check-dependency-audit

CLAUDE.md

@@ -100,7 +100,8 @@ python3 scripts/render_smoke_nonumpy.py  # WebGL2 render path in headless Chromi
 python3 scripts/append_stream_smoke.py   # streaming-append tail uploads + coalesced refines
 uv sync --extra reflex --group dev
 uv run pytest                         # native core required (no fallback)
-python3 scripts/reflex_ws_smoke.py    # browser E2E vs the running Reflex demo app
+python3 scripts/reflex_ws_smoke.py    # browser E2E; sandbox is on by default
+# If Chromium cannot sandbox, pass --no-sandbox only for a trusted --frontend URL.
 uv run ruff check . && uv run ruff format . && uv run ty check
 uv run python scripts/bench.py        # §12 benchmark harness
 python3 scripts/bench_scatter_native.py --render   # xy scatter, no deps

Makefile

@@ -17,7 +17,7 @@ NAME ?=
 RELEASE_VERSION ?= 0.1.0a4
 RELEASE_CLI = uvx reflex-release@$(RELEASE_VERSION)
 
-.PHONY: help setup setup-browser check check-full check-browser check-conformance check-docs check-examples check-security check-errors check-api check-import check-ci check-benchmark-harness check-pyplot check-pyplot-gallery-contract check-pyplot-gallery-extended check-pyplot-gallery-shard check-pyplot-speed check-sdist check-wheel check-artifacts check-benchmark-report list-checks test lint format typecheck public-api python-floor js-check rust-check abi-smoke news news-check
+.PHONY: help setup setup-browser check check-full check-browser check-conformance check-docs check-examples check-security check-security-static check-dependency-audit check-errors check-api check-import check-ci check-benchmark-harness check-pyplot check-pyplot-gallery-contract check-pyplot-gallery-extended check-pyplot-gallery-shard check-pyplot-speed check-sdist check-wheel check-artifacts check-benchmark-report list-checks test lint format typecheck public-api python-floor js-check rust-check abi-smoke news news-check
 
 help:
 	@printf '%s\n' \
@@ -31,7 +31,8 @@ help:
 		'  make check-conformance run accessibility + Chromium/Firefox/WebKit conformance' \
 		'  make check-docs       run documentation examples' \
 		'  make check-examples   run canonical API examples and Reflex asset registry checks' \
-		'  make check-security   run standalone HTML safety and client text-sink checks' \
+		'  make check-security   run standalone HTML safety plus all dependency-advisory audits' \
+		'  make check-dependency-audit audit every active committed dependency lock' \
 		'  make check-errors     run public error, LOD, and mutation-safety tests' \
 		'  make check-api        run lazy public API and type-surface checks' \
 		'  make check-import     run import-time and dependency-boundary checks' \
@@ -114,9 +115,14 @@ check-pyplot-gallery-shard:
 		--profile "$(GALLERY_PROFILE)" \
 		--shard "$(GALLERY_SHARD)"
 
-check-security:
+check-security: check-security-static check-dependency-audit
+
+check-security-static:
 	$(PYTHON) scripts/verify_local.py --only security_export
 
+check-dependency-audit:
+	$(PYTHON) scripts/audit_dependencies.py
+
 check-errors:
 	$(PYTHON) scripts/verify_local.py --only error_safety
 

SECURITY.md

@@ -31,6 +31,12 @@ metadata is rejected.
   `make check-security`.
 - `Figure.to_png` launches local Chromium with the browser sandbox enabled by
   default; `sandbox=False` is an explicit caller opt-out for trusted HTML.
+  A sandboxed launch failure fails closed and is never retried unsandboxed.
 - The native core is a local in-process C-ABI library; it processes only data
   already in the caller's process and performs no I/O or network access.
+- Active committed dependency locks are scanned on relevant pull requests and
+  weekly. Python and Rust fail on vulnerability advisories; npm and Bun fail on high or
+  critical advisories. No ignores are currently allowed. Run
+  `make check-dependency-audit` locally; the scope and frozen-evidence exception
+  are documented in the audit trail.
 - The audit trail lives in `spec/process/security-audit-2026-07-06.md`.

benchmarks/README.md

@@ -411,6 +411,9 @@ flags. Artifacts record `environment.browser_renderer=hardware`.
 The workflow benchmark measures native Rust PNG separately from the opt-in
 `engine=Engine.chromium` screenshot row. The Chromium adapter remains
 `software-gl` because it forces SwiftShader; keep it out of hardware-GPU comparisons.
+That screenshot row explicitly uses `sandbox=False`: its input is the controlled,
+repository-generated chart in `bench_workflows.py`, and hosted CI cannot initialize
+Chromium's sandbox. This is not permission for application exports to opt out.
 Record CPU model/core count, RAM, GPU and driver, OS build, power mode, browser
 version, Python, Rust, Node, package versions, commit, and ambient workload.
 

benchmarks/bench_workflows.py

@@ -346,7 +346,13 @@ def figure() -> Figure:
                     family="export",
                     n=n,
                     setup=figure,
-                    operation=lambda fig: fig.to_png(engine=xy.Engine.chromium),
+                    # The benchmark renders only the controlled figure above.
+                    # GitHub-hosted runners cannot initialize Chromium's sandbox,
+                    # so this repository-owned harness opts out explicitly.
+                    operation=lambda fig: fig.to_png(
+                        engine=xy.Engine.chromium,
+                        sandbox=False,
+                    ),
                     reps=1,
                     category_ids=("static_export", "payload_export_size"),
                     scope="public-chromium-png-export",
@@ -379,6 +385,7 @@ def run(*, profile: str, reps: int, chromium: str | None = None) -> dict[str, An
     if chromium:
         # The opt-in Chromium row forces SwiftShader independently of benchmark flags.
         environment["browser_renderer"] = "software-gl"
+        environment["chromium_sandbox"] = False
     return {
         "schema_version": SCHEMA_VERSION,
         "kind": "workflow-native",

benchmarks/requirements-ci.in

@@ -2,7 +2,7 @@
 # timing changes reflect code changes rather than a competitor release. Refresh
 # the transitive lock intentionally with:
 #
-#   uv pip compile --python-version 3.12 \
+#   uv pip compile --upgrade --python-version 3.12 \
 #     --python-platform x86_64-unknown-linux-gnu \
 #     benchmarks/requirements-ci.in -o benchmarks/requirements-ci.lock
 

benchmarks/requirements-ci.lock

@@ -263,7 +263,7 @@ scipy==1.18.0
     # via datashader
 seaborn==0.13.2
     # via -r benchmarks/requirements-ci.in
-setuptools==83.0.0
+setuptools==84.2.1
     # via dash
 simplejson==4.1.1
     # via choreographer
@@ -273,7 +273,7 @@ stack-data==0.6.3
     # via ipython
 toolz==1.1.0
     # via datashader
-tornado==6.5.7
+tornado==6.6
     # via bokeh
 tqdm==4.69.0
     # via panel
@@ -298,11 +298,11 @@ typing-inspection==0.4.2
     # via pydantic
 uc-micro-py==2.0.0
     # via linkify-it-py
-urllib3==2.7.0
+urllib3==2.8.0
     # via requests
 wcwidth==0.8.2
     # via prompt-toolkit
-werkzeug==3.1.8
+werkzeug==3.1.9
     # via
     #   dash
     #   flask

docs/app/reflex.lock/package.json

@@ -47,7 +47,7 @@
     "postcss": "8.5.29",
     "postcss-import": "17.0.0",
     "tailwindcss": "4.3.0",
-    "vite": "8.3.2"
+    "vite": "8.3.3"
   },
   "overrides": {
     "cookie": "1.1.1"