Bump dependencies and address GHSA-4xgf-cpjx-pc3j (pydantic-settings symlink traversal) #92

New issue

Closed

opened 2026-06-23 08:47:58 +00:00 by coding-agent-marvin8 · 1 comment

coding-agent-marvin8 commented

2026-06-23 08:47:58 +00:00

(Migrated from codeberg.org)

Routine dependency maintenance plus a security fix.

Security: 2.13.1 (transitive via
Usage: bump-my-version [OPTIONS] COMMAND [ARGS]...

Version bump your Python project.

╭─ Options ────────────────────────────────────────────────────────────────────╮
│ --version Show the version and exit. │
│ --help -h Show this message and exit. │
╰──────────────────────────────────────────────────────────────────────────────╯
╭─ Commands ───────────────────────────────────────────────────────────────────╮
│ bump Change the version. │
│ replace Replace the version in files. │
│ sample-config Print a sample configuration file. │
│ show Show current configuration information. │
│ show-bump Show the possible versions resulting from the bump │
│ subcommand. │
╰──────────────────────────────────────────────────────────────────────────────╯) has GHSA-4xgf-cpjx-pc3j — a MEDIUM-severity path traversal via symlinks in NestedSecretsSettingsSource. Fixed by constraining to >=2.14.2 in [tool.uv.constraint-dependencies].

Dependency bumps:

cyclopts 4.18 → 4.19
longwei 2.0.0 → 2.0.1
mkdocstrings-python 2.0.4 → 2.0.5
pytest 9.1.0 → 9.1.1
ty 0.0.51 → 0.0.52
uv 0.11.22 → 0.11.23

Pre-commit hooks updated:

ruff-pre-commit v0.15.17 → v0.15.18
ty-pre-commit v0.0.49 → v0.0.52
uv-pre-commit 0.11.21 → 0.11.23
Removed codelimit hook

Routine dependency maintenance plus a security fix. **Security:** 2.13.1 (transitive via Usage: bump-my-version [OPTIONS] COMMAND [ARGS]... Version bump your Python project. ╭─ Options ────────────────────────────────────────────────────────────────────╮ │ --version Show the version and exit. │ │ --help -h Show this message and exit. │ ╰──────────────────────────────────────────────────────────────────────────────╯ ╭─ Commands ───────────────────────────────────────────────────────────────────╮ │ bump Change the version. │ │ replace Replace the version in files. │ │ sample-config Print a sample configuration file. │ │ show Show current configuration information. │ │ show-bump Show the possible versions resulting from the bump │ │ subcommand. │ ╰──────────────────────────────────────────────────────────────────────────────╯) has GHSA-4xgf-cpjx-pc3j — a MEDIUM-severity path traversal via symlinks in `NestedSecretsSettingsSource`. Fixed by constraining to `>=2.14.2` in `[tool.uv.constraint-dependencies]`. **Dependency bumps:** - `cyclopts` 4.18 → 4.19 - `longwei` 2.0.0 → 2.0.1 - `mkdocstrings-python` 2.0.4 → 2.0.5 - `pytest` 9.1.0 → 9.1.1 - `ty` 0.0.51 → 0.0.52 - `uv` 0.11.22 → 0.11.23 **Pre-commit hooks updated:** - `ruff-pre-commit` v0.15.17 → v0.15.18 - `ty-pre-commit` v0.0.49 → v0.0.52 - `uv-pre-commit` 0.11.21 → 0.11.23 - Removed `codelimit` hook

coding-agent-marvin8 commented

2026-06-23 08:48:11 +00:00

(Migrated from codeberg.org)

Plan of attack:

Branch: chore/issue-92-dep-bumps-security
All changes are already staged; just need to reset Release-Notes.md, commit, push, and open the PR.

Commits planned:

:wrench: bump deps, fix GHSA-4xgf-cpjx-pc3j pydantic-settings constraint

The security advisory (GHSA-4xgf-cpjx-pc3j) applies only to the NestedSecretsSettingsSource with secrets_nested_subdir=True in a symlink-writable directory — feed2fedi itself does not use pydantic-settings, but we constrain it to pull in the fixed version for the dev toolchain.

**Plan of attack:** - Branch: `chore/issue-92-dep-bumps-security` - All changes are already staged; just need to reset Release-Notes.md, commit, push, and open the PR. **Commits planned:** 1. `:wrench: bump deps, fix GHSA-4xgf-cpjx-pc3j pydantic-settings constraint` The security advisory (GHSA-4xgf-cpjx-pc3j) applies only to the `NestedSecretsSettingsSource` with `secrets_nested_subdir=True` in a symlink-writable directory — feed2fedi itself does not use pydantic-settings, but we constrain it to pull in the fixed version for the dev toolchain.