marvin8/playlist2podcasts
Archived
Watch
1
0
Fork
You've already forked playlist2podcasts
 0
Code Issues Pull requests Projects Releases 50 Packages Wiki Activity Actions

Security release: pin lxml and urllib3 transitive deps #31

Closed
opened 2026-05-24 06:19:48 +00:00 by coding-agent-marvin8 · 1 comment
coding-agent-marvin8 commented 2026-05-24 06:19:48 +00:00 (Migrated from codeberg.org)
Copy link

Two transitive dependency vulnerabilities require pinning via uv constraint-dependencies:

  • GHSA-vfmq-68hx-4jfw: lxml < 6.1.0 (fix: lxml>=6.1.0)
  • GHSA-qccp-gfcp-xxvc: urllib3 < 2.7.0 (fix: urllib3>=2.7.0)

Also bundled: CLAUDE.md maintenance (remove Co-Authored-By guidance) and addition of .claude/settings.local.json to version control.

Two transitive dependency vulnerabilities require pinning via uv constraint-dependencies: - GHSA-vfmq-68hx-4jfw: lxml < 6.1.0 (fix: lxml>=6.1.0) - GHSA-qccp-gfcp-xxvc: urllib3 < 2.7.0 (fix: urllib3>=2.7.0) Also bundled: CLAUDE.md maintenance (remove Co-Authored-By guidance) and addition of .claude/settings.local.json to version control.
coding-agent-marvin8 commented 2026-05-24 06:21:02 +00:00 (Migrated from codeberg.org)
Copy link

Findings from pysentry-rs 0.4.5:

  • GHSA-vfmq-68hx-4jfw (lxml) — already addressed via constraint-dependencies
  • GHSA-qccp-gfcp-xxvc (urllib3) — already addressed via constraint-dependencies
  • GHSA-65pc-fj4g-8rjx (idna v3.11, MEDIUM) — new finding, fix: idna>=3.15

Plan:

  1. Add idna>=3.15 to constraint-dependencies in pyproject.toml
  2. Run uv sync to update uv.lock
  3. Re-run pysentry to confirm clean scan
  4. Commit all pending changes in three logical commits
  5. Open PR targeting main
**Findings from pysentry-rs 0.4.5:** - GHSA-vfmq-68hx-4jfw (lxml) — already addressed via constraint-dependencies - GHSA-qccp-gfcp-xxvc (urllib3) — already addressed via constraint-dependencies - GHSA-65pc-fj4g-8rjx (idna v3.11, MEDIUM) — **new finding**, fix: idna>=3.15 **Plan:** 1. Add `idna>=3.15` to constraint-dependencies in pyproject.toml 2. Run `uv sync` to update uv.lock 3. Re-run pysentry to confirm clean scan 4. Commit all pending changes in three logical commits 5. Open PR targeting main
Commenting is not possible because the repository is archived.
No Branch/Tag specified
Branches Tags
main
wip
2026.6.18
2026.6.12
2026.6.7
2026.5.24
2026.5.17
2026.4.25
2026.4.11
2026.4.5
2026.4.2
2026.3.24
2026.3.7
2026.2.22
2026.2.14
2026.2.11
2026.2.5
2026.2.1
2026.1.31
2026.1.30
2026.1.19
2026.1.9
2.2.19
2.2.18
2.2.17
2.2.16
2.2.15
2.2.14
2.2.13
2.2.12
2.2.11
2.2.10
2.2.9
2.2.28
2.2.7
2.2.6
2.2.5
2.2.4
2.2.3
2.2.2
2.2.1
2.2.0
2.1.1
2.1.0
2.0.1
2.0.0
1.1.1
1.1.0
1.0.0
0.6.8
0.6.7
0.6.6
0.6.5
0.6.4
0.6.3
0.6.2
0.6.1
0.6.0
0.5.10
0.5.9
0.5.8
0.5.7
0.5.6
0.5.5
V0.5.5
V0.5.4
0.5.3
V0.5.3
0.5.2
V0.5.2
0.5.1
V0.5.1
V0.5.0
0.5.0
0.4.3
0.4.2
v0.4.2
0.4.1
0.4.0
0.3.1
0.3.0
0.2.4
0.2.3
Labels
Clear labels   
Ideas
Ideas for future features

No labels
Ideas
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
marvin8/playlist2podcasts#31
No description provided.