fix(deps): bump dependencies to resolve dependabot alerts - #24
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates development dependencies in pyproject.toml, upgrading pytest and pymdown-extensions. It also updates the lockfile uv.lock to reflect these upgrades along with version bumps for several other packages (such as filelock, idna, marshmallow, mkdocs-material, pyasn1, pygments, requests, setuptools, urllib3, and virtualenv) and adds python-discovery as a new dependency. There are no review comments, and I have no feedback to provide.
9ee3ffc to
0c207b8
Compare
There was a problem hiding this comment.
Pull request overview
This PR addresses Dependabot vulnerability alerts by upgrading several Python dependencies to patched versions (via a regenerated uv.lock) and adjusting pyproject.toml constraints to prevent resolving known-vulnerable versions going forward.
Changes:
- Relax
pytestdev dependency from an exact pin to a minimum version, and raise the minimumpymdown-extensionsversion inpyproject.toml. - Regenerate
uv.lockwith upgraded (patched) versions for impacted direct/transitive packages (e.g.,urllib3,requests,pyasn1,filelock,virtualenv, etc.).
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
pyproject.toml |
Updates dev dependency constraints to allow/require patched versions (notably pytest and pymdown-extensions). |
uv.lock |
Regenerated lockfile reflecting upgraded dependency graph and resolved patched versions. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Upgrade vulnerable packages to patched versions: - urllib3 2.5.0 -> 2.7.0 (high: decompression chain/redirects/header forwarding) - pyasn1 0.6.1 -> 0.6.4 (high: decoder DoS, recursion, OID complexity) - pymdown-extensions 10.16.1 -> 11.0.2 (high: ReDoS; medium: path traversal) - requests 2.32.5 -> 2.34.2 (medium: insecure temp file reuse) - setuptools 80.9.0 -> 84.0.0 (medium: MANIFEST.in exclusion bypass) - idna 3.10 -> 3.19 (medium: CVE-2024-3651 fix bypass) - pytest 8.4.2 -> 9.1.1 (medium: tmpdir handling) - filelock 3.18.0 -> 3.32.5 (medium: TOCTOU symlink) - virtualenv 20.33.1 -> 21.7.7 (medium: TOCTOU directory creation) - marshmallow 3.26.1 -> 3.26.2 (medium: DoS in Schema.load(many)) - pygments 2.19.2 -> 2.21.0 (low: ReDoS in GUID matching) Signed-off-by: thxCode <thxcode0824@gmail.com>
Signed-off-by: thxCode <thxcode0824@gmail.com>
8af1cbc to
69cd9ce
Compare
Summary
Resolve all 21 open Dependabot alerts (10 high, 10 moderate, 1 low) by upgrading vulnerable packages in
uv.lockto their patched versions:Changes
pyproject.toml: relaxpytest==8.4.2topytest>=9.0.3and raisepymdown-extensionsfloor to>=11.0.1so vulnerable versions can no longer be resolveduv.lock: regenerated viauv lock --upgrade-package ...for the affected packages (mkdocs-material 9.6.18 -> 9.7.7 came along as a compatible bump)Verification
uv run pytest: 613 passed, 20 skipped with pytest 9.1.1