Patch critical and high Dependabot alerts - #461
Merged
Merged
Conversation
Promote generator qualification and reward fixes to main
Promote unanswered-challenge skip to main
Bucketed qualified/onboarding/probe slots were starving some miners; the default is a uniform draw again, with buckets still available as an opt-in. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Restore uniform random generator challenge sampling
Pin GitPython, Pillow, aiohttp, cryptography, FastAPI, and Starlette to patched releases so the GitPython RCE and other high-severity lockfile advisories clear without bumping torch or transformers. Co-authored-by: Cursor <cursoragent@cursor.com>
There was a problem hiding this comment.
🟡 Changes recommended
uv.lock metadata is inconsistent with pyproject.toml for the GitPython constraint, indicating the lockfile may not be fully regenerated from the updated project requirements.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
This PR updates Python dependency constraints and the uv lockfile to address critical/high Dependabot alerts by moving to patched versions of key packages (notably GitPython, cryptography, aiohttp, Pillow, FastAPI/Starlette).
Changes:
- Updated
pyproject.tomldependency constraints to require patched versions for vulnerable packages. - Refreshed
uv.lockto resolve to updated package versions (e.g., aiohttp 3.14.3, cryptography 50.0.1, GitPython 3.1.62, Pillow 12.3.0, FastAPI 0.141.1, Starlette 1.6.0).
File summaries
| File | Description |
|---|---|
pyproject.toml |
Updates dependency constraints to require patched versions addressing security advisories. |
uv.lock |
Re-locks the environment to the newer, patched dependency versions and their artifacts. |
Review details
- Files reviewed: 1/2 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+26
to
+29
| "GitPython>=3.1.62", # 3.1.62 closes CRITICAL GHSA-284h-m62q-gf8w and later HIGH git option/RCE advisories | ||
| "cryptography>=50.0.0", # 50.0.0 closes HIGH PKCS#7 Bleichenbacher oracle | ||
| "fastapi>=0.115.14", | ||
| "starlette>=1.3.1", # 1.3.1 closes HIGH multipart/form DoS and StaticFiles SSRF |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
uv.lockso requirement metadata matchespyproject.toml, including GitPython. Exact pins prevent unlocked installations selecting untested newer versions of these packages.Also brings main's existing uniform-random challenge allocation and 5.0.7 version bump into testnet.
Validation
git diff --checkpassed.uv lock --check --offlinepassed.