fix: tighten constraint-dependencies to resolve pysentry vulnerabilities #95

Merged

coding-agent-marvin8 merged 0 commits from refs/pull/95/head into main

2026-06-21 20:52:56 +00:00

coding-agent-marvin8 commented

2026-06-21 09:55:46 +00:00

(Migrated from codeberg.org)

Upgrades three transitive dependencies to clear 7 vulnerabilities (2 HIGH, 1 MEDIUM, 4 LOW) flagged by nox -s pysentry:

starlette 1.1.0 → 1.3.1: form size limits ignored for url-encoded bodies (GHSA-82w8-qh3p-5jfq, HIGH); path-based URL authority spoofing (GHSA-jp82-jpqv-5vv3, LOW)
python-multipart 0.0.29 → 0.0.32: quadratic CPU DoS in querystring parser (GHSA-5rvq-cxj2-64vf, HIGH); negative Content-Length unbounded read (GHSA-r589-f936-vvph, LOW); two further LOW issues
pydantic-settings 2.14.1 → 2.14.2: one vulnerability

Also bumps uvicorn to 0.49.0 (latest stable; required to pass the zaojun pre-commit hook).

Closes #94

Upgrades three transitive dependencies to clear 7 vulnerabilities (2 HIGH, 1 MEDIUM, 4 LOW) flagged by `nox -s pysentry`: - **starlette** 1.1.0 → 1.3.1: form size limits ignored for url-encoded bodies (GHSA-82w8-qh3p-5jfq, HIGH); path-based URL authority spoofing (GHSA-jp82-jpqv-5vv3, LOW) - **python-multipart** 0.0.29 → 0.0.32: quadratic CPU DoS in querystring parser (GHSA-5rvq-cxj2-64vf, HIGH); negative Content-Length unbounded read (GHSA-r589-f936-vvph, LOW); two further LOW issues - **pydantic-settings** 2.14.1 → 2.14.2: one vulnerability Also bumps uvicorn to 0.49.0 (latest stable; required to pass the zaojun pre-commit hook). Closes #94

No reviewers

No labels

No milestone

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

marvin8/cang!95

No description provided.

Rows
Columns