Security: upgrade click and soupsieve to fix 3 HIGH vulnerabilities #97

New issue

Closed

opened 2026-07-18 23:17:33 +00:00 by coding-agent-marvin8 · 1 comment

coding-agent-marvin8 commented

2026-07-18 23:17:33 +00:00

(Migrated from codeberg.org)

PYSENTRY flagged 3 HIGH severity vulnerabilities in transitive dependencies:

PYSEC-2026-2132: click 8.3.2 — command injection in click.edit() (fix: 8.3.3+)
PYSEC-2026-3072: soupsieve 2.8.3 — ReDoS via selector parser (fix: 2.8.4+)
PYSEC-2026-3071: soupsieve 2.8.3 — memory exhaustion via large comma-separated selector lists (fix: 2.8.4+)

Both are transitive dependencies — not directly pinned in pyproject.toml.

PYSENTRY flagged 3 HIGH severity vulnerabilities in transitive dependencies: - PYSEC-2026-2132: click 8.3.2 — command injection in click.edit() (fix: 8.3.3+) - PYSEC-2026-3072: soupsieve 2.8.3 — ReDoS via selector parser (fix: 2.8.4+) - PYSEC-2026-3071: soupsieve 2.8.3 — memory exhaustion via large comma-separated selector lists (fix: 2.8.4+) Both are transitive dependencies — not directly pinned in pyproject.toml.

coding-agent-marvin8 commented

2026-07-18 23:17:59 +00:00

(Migrated from codeberg.org)

Exploration findings: both click and soupsieve are purely transitive — they appear in uv.lock but are not directly constrained in pyproject.toml.

Plan of attack:

Run uv lock --upgrade-package click --upgrade-package soupsieve (already done: click 8.3.2→8.4.2, soupsieve 2.8.3→2.8.4)
Regenerate pylock.toml via uv export --format pylock.toml
Commit uv.lock + pylock.toml on branch fix/issue-97-security-deps
Run full check suite (ruff, ty, complexipy, nox pytest) to verify nothing broke
Open PR targeting main

Exploration findings: both click and soupsieve are purely transitive — they appear in uv.lock but are not directly constrained in pyproject.toml. Plan of attack: - Run `uv lock --upgrade-package click --upgrade-package soupsieve` (already done: click 8.3.2→8.4.2, soupsieve 2.8.3→2.8.4) - Regenerate pylock.toml via `uv export --format pylock.toml` - Commit uv.lock + pylock.toml on branch fix/issue-97-security-deps - Run full check suite (ruff, ty, complexipy, nox pytest) to verify nothing broke - Open PR targeting main