Repository navigation
fix(deps): bump certifi and virtualenv to clear pip-audit advisories - #232
Merged
Merged
Conversation
The Quality Gate pip-audit step fails on every PR because of three new advisories against packages pinned in uv.lock: - certifi 2026.2.25 -> 2026.10.19 (PYSEC-2026-4320, revoked emSign root) - virtualenv 21.14.2 -> 21.14.12 (CVE-2026-113725, CVE-2026-113726) - distlib 0.4.0 -> 0.4.4 (moved with virtualenv, which requires >=0.4.3) Generated with `uv lock --upgrade-package certifi --upgrade-package virtualenv`. Fixes #231 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013fePq8hgqbtNvf2pNvA3WC
tmatup
requested review from
CarlesUIPath,
akshaylive,
bai-uipath and
uipreliga
as code owners
October 21, 2026 22:12
|
Claude finished @tmatup's task in 1m 0s —— View job Reviewing PR #232: Dependency security updates
|
4 tasks done
bai-uipath
approved these changes
Oct 21, 2026
1 of 2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bottom line
The required
Quality Gatecheck fails on every PR at the pip-audit step. Three new advisories hit two packages pinned inuv.lock. This PR bumps them. Onlyuv.lockchanges.Fixes #231
What changed
Generated with:
emSign ECC Root CA - G3root)activateshell injection)distlib>=0.4.3All three releases are older than CI's 12-hour minimum package age (distlib 0.4.4 uploaded 2026-10-16, certifi 2026-10-20 02:24 UTC, virtualenv 2026-10-21 01:58 UTC).
Verification
uv sync --frozenwith CI's extras, then CI's exact pip-audit command (same--ignore-vulnlist):No known vulnerabilities found, 2 ignored.make verify: passes (6385 passed, 5 skipped, coverage 93.23%).Note:
make verifyhas the pip-audit line commented out, so it would not have caught this locally. That is left for a separate change, as #231 suggests.🤖 Generated with Claude Code
Co-Authored-By: Claude