Repository navigation
fix(deps): patch Dependabot security alerts - #75
Merged
Merged
Conversation
Upgrade the two vulnerable packages in the release tool lock (scripts/release/uv.lock) to their first patched versions: - urllib3 2.7.0 -> 2.8.0 (GHSA-8988-9cw3-xx77, GHSA-vxq7-64xx-v4gw, GHSA-gh4c-6fx4-qh6g). Transitive, through requests. - uv 0.12.13 -> 0.12.18 (GHSA-2cv4-cqwr-gwf7). Pinned in the release dependency group. The release workflow installs uv through setup-uv with the same pinned version, and the release contract test asserts both pins, so all three move together. No other package in either lock changes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes all four open Dependabot alerts. All four are in the release tool lock,
scripts/release/uv.lock. Each package moves to its first patched version, and nothing else in either lock changes.Changes
scripts/release/uv.lock: relocked withuv lock --upgrade-package uv==0.12.18 --upgrade-package urllib3==2.8.0. urllib3 comes in throughrequests.scripts/release/pyproject.toml: release group pinuv==0.12.13changed touv==0.12.18..github/workflows/release.yml:setup-uvversionchanged to0.12.18, so the uv that runs the release matches the locked one.tests/test_release_contract.py: the two assertions that check the uv pin now expect 0.12.18.None of the open Dependabot PRs (#64 to #71) touches urllib3 or uv. This branch does not overlap with #74.
Verification
All steps ran locally with uv 0.12.18, following the CI steps:
uv sync --locked --extra dev, thenuv run ruff check .: passed.uv sync --locked --project scripts/release, thenscripts/check_release_runtime.py: passed. The release environment reports uv 0.12.18 and urllib3 2.8.0.uv run --locked --project scripts/release uv build --no-build-isolation, thenscripts/check_source_boundary.py --require-dist: passed.pytest tests -q: 331 passed, 2 skipped.pip-audit --require-hasheson both exported locks (release tools and root with all extras): no known vulnerabilities.🤖 Generated with Claude Code