Repository navigation
fix(deps): bump certifi, packaging and virtualenv to resolve Dependabot CVEs - #128
Merged
Merged
Conversation
…ot CVEs Resolves 7 open Dependabot security alerts: - certifi 2026.7.22 -> 2026.10.19 (GHSA-6q48-6c7w-9gw2, critical: compromised emSign intermediate CA keys; runtime transitive dep of httpx/httpcore) - virtualenv 21.14.2 -> 21.14.13 (CVE-2026-113716/21/22/24/25/26, activate script/launcher injection and symlink flaws; dev-only transitive dep of pre-commit) - packaging 24.0 -> 26.3 (required by virtualenv >= 21.14.6; project only uses the stable Version/InvalidVersion API) Validated with ruff check and the unit/integration suite (2025 passed; 3 pre-existing network-fixture failures also fail on main).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves the 7 open Dependabot alerts on this repository.
certifivirtualenvpackagingRoot cause
virtualenv>=21.14.6requirespackaging>=26.3, butpyproject.tomlpinnedpackaging==24.0. Without this bump,uv's resolver could not liftvirtualenvpast 21.14.5, leaving 6 alerts open.The project only uses
packaging.version.VersionandInvalidVersion(core/analyzers/cve/models.py), an API that has been stable across 24 -> 26.Applicability
httpx/httpcore— it is the CA bundleHTTPClientuses to validate TLS on every scan. Real MITM risk.pre-commit(thedevextra); it is not installed byuv sync,uv sync --extra api, nor when publishing the package. It is updated anyway because the bump is lockfile-only, risk-free, and clears the alerts table.Changes
pyproject.toml:packaging==24.0->packaging==26.3uv.lock:certifi,virtualenvandpackaging(pluspython-discovery1.6.0 -> 1.6.4, avirtualenvtransitive)Validation
uv sync --extra api --extra devresolves without conflictsuv run ruff check .— all checks passuv run pytest -m "not slow and not network"— 2025 passed, 3 failedmain(httpx.ConnectError: Blocked non-loopback connection to 93.184.216.34intest_api_auth.py::TestGenerateKeyandtest_api_config.py::TestOpenAPIDiscovery, blocked by the network fixture)Notes
dependabot.ymlis configured: GitHub's weekly defaults are in use. A config limiting updates to security-only can be added if desired.