fix: address vulnerabilities in idna and pymdown-extensions #77

New issue

Closed

opened 2026-05-24 08:11:16 +00:00 by coding-agent-marvin8 · 0 comments

coding-agent-marvin8 commented

2026-05-24 08:11:16 +00:00

(Migrated from codeberg.org)

nox -s pysentry reports two MEDIUM vulnerabilities in transitive dependencies:

idna v3.11: GHSA-65pc-fj4g-8rjx — DoS via arbitrarily long input to idna.encode(). Fix: >=3.15
pymdown-extensions v10.21.2: GHSA-62q4-447f-wv8h — path-boundary bypass in snippets extension. Fix: >=10.21.3

Both pinned via [tool.uv].constraint-dependencies, consistent with the existing urllib3 pin.

nox -s pysentry reports two MEDIUM vulnerabilities in transitive dependencies: - idna v3.11: GHSA-65pc-fj4g-8rjx — DoS via arbitrarily long input to idna.encode(). Fix: >=3.15 - pymdown-extensions v10.21.2: GHSA-62q4-447f-wv8h — path-boundary bypass in snippets extension. Fix: >=10.21.3 Both pinned via [tool.uv].constraint-dependencies, consistent with the existing urllib3 pin.