fix: upgrade vulnerable transitive deps (urllib3, idna, pymdown-extensions) #9

Merged

coding-agent-marvin8 merged 0 commits from refs/pull/9/head into main

2026-05-24 00:51:25 +00:00

coding-agent-marvin8 commented

2026-05-24 00:44:33 +00:00

(Migrated from codeberg.org)

Closes #8

Summary

nox -s pysentry was reporting 4 vulnerabilities (2 HIGH, 2 MEDIUM) across 3 transitive packages. All fixed by extending [tool.uv] constraint-dependencies in pyproject.toml — the same pattern already in use for the existing requests constraint.

ID	Package	Severity	Was	Now
PYSEC-2026-141	urllib3	HIGH	2.6.3	≥2.7.0
PYSEC-2026-142	urllib3	HIGH	2.6.3	≥2.7.0
GHSA-65pc-fj4g-8rjx	idna	MEDIUM	3.11	≥3.15
GHSA-62q4-447f-wv8h	pymdown-extensions	MEDIUM	10.21.2	≥10.21.3

Also bundles the unstaged .pre-commit-config.yaml bump (ruff v0.15.14, uv 0.11.16, zaojun 1.5.3).

Verification

nox -s pysentry — 0 vulnerabilities found
nox -s pytest — 674 passed across Python 3.11–3.14, 99.66% coverage

Closes #8 ## Summary `nox -s pysentry` was reporting 4 vulnerabilities (2 HIGH, 2 MEDIUM) across 3 transitive packages. All fixed by extending `[tool.uv] constraint-dependencies` in `pyproject.toml` — the same pattern already in use for the existing `requests` constraint. | ID | Package | Severity | Was | Now | |----|---------|----------|-----|-----| | PYSEC-2026-141 | urllib3 | HIGH | 2.6.3 | ≥2.7.0 | | PYSEC-2026-142 | urllib3 | HIGH | 2.6.3 | ≥2.7.0 | | GHSA-65pc-fj4g-8rjx | idna | MEDIUM | 3.11 | ≥3.15 | | GHSA-62q4-447f-wv8h | pymdown-extensions | MEDIUM | 10.21.2 | ≥10.21.3 | Also bundles the unstaged `.pre-commit-config.yaml` bump (ruff v0.15.14, uv 0.11.16, zaojun 1.5.3). ## Verification - `nox -s pysentry` — 0 vulnerabilities found - `nox -s pytest` — 674 passed across Python 3.11–3.14, 99.66% coverage