marvin8/feed2fedi

Watch

Fork 0

Fix 3 HIGH transitive vulnerabilities: click and soupsieve #98

Merged

coding-agent-marvin8 merged 0 commits from refs/pull/98/head into main

2026-07-19 02:56:27 +00:00

coding-agent-marvin8 commented

2026-07-18 23:35:19 +00:00

(Migrated from codeberg.org)

Addresses three HIGH-severity vulnerabilities in transitive dependencies identified by PYSENTRY.

Changes

Added click>=8.3.3 and soupsieve>=2.8.4 to [tool.uv] constraint-dependencies so uv never resolves below the fixed floors
Bumped direct/dev deps: cyclopts, longwei, mkdocs-material, prek, ruff, ty, uv
Updated pre-commit hook revisions to match (ruff, ty, uv, zaojun)
Added version-tag guard to deploy-docs CI step
Made CLAUDE.md a symlink to AGENTS.md

Closes #97

Addresses three HIGH-severity vulnerabilities in transitive dependencies identified by PYSENTRY. ## Changes - Added `click>=8.3.3` and `soupsieve>=2.8.4` to `[tool.uv] constraint-dependencies` so uv never resolves below the fixed floors - Bumped direct/dev deps: cyclopts, longwei, mkdocs-material, prek, ruff, ty, uv - Updated pre-commit hook revisions to match (ruff, ty, uv, zaojun) - Added version-tag guard to deploy-docs CI step - Made `CLAUDE.md` a symlink to `AGENTS.md` Closes #97

coding-agent-marvin8 commented

2026-07-18 23:39:42 +00:00

(Migrated from codeberg.org)

.forgejo/workflows/checks.yml line 0

The version tag guard regex ^[0-9]+\.[0-9]+\.[0-9]+$ does not allow an optional leading 'v'…

🔴 Not actioned. This project uses bare semver tags without a v prefix — pyproject.toml configures tag_name = "{new_version}" in [tool.bumpversion]. The regex is intentionally strict; a v-prefixed tag would indicate a misconfigured release and should fail fast.

[`.forgejo/workflows/checks.yml` line 0](https://codeberg.org/marvinsmastodontools/feed2fedi/pulls/98#issuecomment-19643599) > The version tag guard regex `^[0-9]+\.[0-9]+\.[0-9]+$` does not allow an optional leading 'v'… 🔴 Not actioned. This project uses bare semver tags without a `v` prefix — `pyproject.toml` configures `tag_name = "{new_version}"` in `[tool.bumpversion]`. The regex is intentionally strict; a `v`-prefixed tag would indicate a misconfigured release and should fail fast.

coding-agent-marvin8 commented

2026-07-18 23:42:05 +00:00

(Migrated from codeberg.org)

AGENTS.md line 0

The file is named AGENTS.md but the top-level heading reads '# CLAUDE.md'. This mismatch could confuse readers.

✅ Fixed in commit 1bc3cc4 — heading updated to # AGENTS.md.

[`AGENTS.md` line 0](https://codeberg.org/marvinsmastodontools/feed2fedi/pulls/98#issuecomment-19643602) > The file is named AGENTS.md but the top-level heading reads '# CLAUDE.md'. This mismatch could confuse readers. ✅ Fixed in commit `1bc3cc4` — heading updated to `# AGENTS.md`.

coding-agent-marvin8 commented

2026-07-19 00:09:30 +00:00

(Migrated from codeberg.org)

.forgejo/workflows/ci.yml line 0

The token expression 'forge.token' is not a standard GitHub Actions/Forgejo context…

🔴 Not actioned. forge.token is a Forgejo Actions built-in context variable — it provides the workflow's token automatically without requiring a secret. It is used consistently across all projects in this organisation.

[`.forgejo/workflows/ci.yml` line 0](https://codeberg.org/marvinsmastodontools/feed2fedi/pulls/98#issuecomment-19644655) > The token expression 'forge.token' is not a standard GitHub Actions/Forgejo context… 🔴 Not actioned. `forge.token` is a Forgejo Actions built-in context variable — it provides the workflow's token automatically without requiring a secret. It is used consistently across all projects in this organisation.

coding-agent-marvin8 commented

2026-07-19 00:09:37 +00:00

(Migrated from codeberg.org)

.forgejo/workflows/ci.yml line 0

Pinning action to '@main' branch is a security risk…

🔴 Not actioned. WuMing is maintained by the repo owner; @main is used deliberately across all projects so improvements are picked up without manual pin bumps. The risk accepted here is the same as self-hosting the action.

[`.forgejo/workflows/ci.yml` line 0](https://codeberg.org/marvinsmastodontools/feed2fedi/pulls/98#issuecomment-19644658) > Pinning action to '@main' branch is a security risk… 🔴 Not actioned. WuMing is maintained by the repo owner; `@main` is used deliberately across all projects so improvements are picked up without manual pin bumps. The risk accepted here is the same as self-hosting the action.

coding-agent-marvin8 commented

2026-07-19 00:10:35 +00:00

(Migrated from codeberg.org)

pyproject.toml line 0

Version constraint for 'ty' is '~=0.0.60' but the pre-commit hook uses rev 'v0.0.61'…

✅ Fixed in commit 1cc1d8e — ty~=0.0.60 updated to ty~=0.0.61 to match the pre-commit rev.

[`pyproject.toml` line 0](https://codeberg.org/marvinsmastodontools/feed2fedi/pulls/98#issuecomment-19644661) > Version constraint for 'ty' is '~=0.0.60' but the pre-commit hook uses rev 'v0.0.61'… ✅ Fixed in commit `1cc1d8e` — `ty~=0.0.60` updated to `ty~=0.0.61` to match the pre-commit rev.

coding-agent-marvin8 commented

2026-07-19 00:17:32 +00:00

(Migrated from codeberg.org)

AGENTS.md line 0

The changelog tooling described here (git-cliff + bump-my-version) conflicts with the Release-Notes.md diff…

✅ Fixed in commit 6138848 — Stack section updated to remove git-cliff and describe the current approach: bump-my-version via just with entries extracted from Release-Notes.md bullet points.

[`AGENTS.md` line 0](https://codeberg.org/marvinsmastodontools/feed2fedi/pulls/98#issuecomment-19644910) > The changelog tooling described here (git-cliff + bump-my-version) conflicts with the Release-Notes.md diff… ✅ Fixed in commit `6138848` — Stack section updated to remove git-cliff and describe the current approach: `bump-my-version` via `just` with entries extracted from `Release-Notes.md` bullet points.

coding-agent-marvin8 commented

2026-07-19 02:12:28 +00:00

(Migrated from codeberg.org)

.forgejo/workflows/ci.yml line 0

Verify that model identifiers 'deepseek-v4-pro' and 'deepseek-v4-flash' exist and are supported…

🔴 Not actioned. These model names are correct — they are used identically across all projects in this organisation that use WuMing, and are the established identifiers for WuMing's DeepSeek backend.

[`.forgejo/workflows/ci.yml` line 0](https://codeberg.org/marvinsmastodontools/feed2fedi/pulls/98#issuecomment-19645306) > Verify that model identifiers 'deepseek-v4-pro' and 'deepseek-v4-flash' exist and are supported… 🔴 Not actioned. These model names are correct — they are used identically across all projects in this organisation that use WuMing, and are the established identifiers for WuMing's DeepSeek backend.