Security: upgrade vulnerable transitive dependencies #8

New issue

Closed

opened 2026-05-24 00:38:11 +00:00 by coding-agent-marvin8 · 1 comment

coding-agent-marvin8 commented

2026-05-24 00:38:11 +00:00

(Migrated from codeberg.org)

pysentry (nox -s pysentry) reports 4 vulnerabilities across 3 transitive packages, all fixable by version upgrades.

Findings

ID	Package	Severity	Current	Fix
PYSEC-2026-141	urllib3	HIGH	2.6.3	≥2.7.0
PYSEC-2026-142	urllib3	HIGH	2.6.3	≥2.7.0
GHSA-65pc-fj4g-8rjx	idna	MEDIUM	3.11	≥3.15
GHSA-62q4-447f-wv8h	pymdown-extensions	MEDIUM	10.21.2	≥10.21.3

All are transitive — none are direct dependencies of longwei. urllib3 and idna are pulled in by httpx (direct prod dep) and the existing requests constraint; pymdown-extensions is pulled in by mkdocs-material in the docs dependency group only.

pysentry (nox -s pysentry) reports 4 vulnerabilities across 3 transitive packages, all fixable by version upgrades. **Findings** | ID | Package | Severity | Current | Fix | |----|---------|----------|---------|-----| | PYSEC-2026-141 | urllib3 | HIGH | 2.6.3 | ≥2.7.0 | | PYSEC-2026-142 | urllib3 | HIGH | 2.6.3 | ≥2.7.0 | | GHSA-65pc-fj4g-8rjx | idna | MEDIUM | 3.11 | ≥3.15 | | GHSA-62q4-447f-wv8h | pymdown-extensions | MEDIUM | 10.21.2 | ≥10.21.3 | All are transitive — none are direct dependencies of longwei. urllib3 and idna are pulled in by httpx (direct prod dep) and the existing requests constraint; pymdown-extensions is pulled in by mkdocs-material in the docs dependency group only.

coding-agent-marvin8 commented

2026-05-24 01:27:26 +00:00

(Migrated from codeberg.org)

Plan of attack

All four findings are transitive deps — no library source code changes needed.

The existing `[tool.uv] constraint-dependencies` in `pyproject.toml` already pins `requests>=2.33.0` using exactly this pattern. We extend the list:

```toml
[tool.uv]
constraint-dependencies = [
"requests>=2.33.0", # GHSA-gc5v-m9x4-r6x2
"urllib3>=2.7.0", # PYSEC-2026-141, PYSEC-2026-142
"idna>=3.15", # GHSA-65pc-fj4g-8rjx
"pymdown-extensions>=10.21.3", # GHSA-62q4-447f-wv8h
]
```

Then run `uv lock` to update the lockfile, commit both files. Verified by re-running `nox -s pysentry` expecting 0 findings.

Also bundling a separate commit for the unstaged `.pre-commit-config.yaml` bump (ruff v0.15.14, uv 0.11.16, zaojun 1.5.3).

**Plan of attack** All four findings are transitive deps — no library source code changes needed. The existing \`[tool.uv] constraint-dependencies\` in \`pyproject.toml\` already pins \`requests>=2.33.0\` using exactly this pattern. We extend the list: \`\`\`toml [tool.uv] constraint-dependencies = [ "requests>=2.33.0", # GHSA-gc5v-m9x4-r6x2 "urllib3>=2.7.0", # PYSEC-2026-141, PYSEC-2026-142 "idna>=3.15", # GHSA-65pc-fj4g-8rjx "pymdown-extensions>=10.21.3", # GHSA-62q4-447f-wv8h ] \`\`\` Then run \`uv lock\` to update the lockfile, commit both files. Verified by re-running \`nox -s pysentry\` expecting 0 findings. Also bundling a separate commit for the unstaged \`.pre-commit-config.yaml\` bump (ruff v0.15.14, uv 0.11.16, zaojun 1.5.3).