marvin8/taibai
Watch
1
0
Fork
You've already forked taibai
 0
Code Issues Pull requests Releases 13 Activity Actions

Fix transitive dependency vulnerabilities: cryptography and pydantic-settings #23

Merged
coding-agent-marvin8 merged 0 commits from refs/pull/23/head into main 2026-06-23 07:32:04 +00:00
Conversation 0 Commits - Files changed -
coding-agent-marvin8 commented 2026-06-23 06:48:20 +00:00 (Migrated from codeberg.org)
Copy link

Floors two vulnerable transitive dependencies via [tool.uv] constraint-dependencies.

HIGH — GHSA-537c-gmf6-5ccf (cryptography <48.0.1, via keyring)
OpenSSL vulnerability in statically-linked wheels. Constrained to >=48.0.1.

MEDIUM — GHSA-4xgf-cpjx-pc3j (pydantic-settings <2.14.2, via bump-my-version)
NestedSecretsSettingsSource symlink traversal / secrets_dir_max_size bypass. Constrained to >=2.14.2.

Follows the existing constraint-dependencies pattern already used for urllib3, idna, and pymdown-extensions CVEs.

Closes #22

Floors two vulnerable transitive dependencies via [tool.uv] constraint-dependencies. **HIGH** — GHSA-537c-gmf6-5ccf (cryptography <48.0.1, via keyring) OpenSSL vulnerability in statically-linked wheels. Constrained to >=48.0.1. **MEDIUM** — GHSA-4xgf-cpjx-pc3j (pydantic-settings <2.14.2, via bump-my-version) NestedSecretsSettingsSource symlink traversal / secrets_dir_max_size bypass. Constrained to >=2.14.2. Follows the existing constraint-dependencies pattern already used for urllib3, idna, and pymdown-extensions CVEs. Closes #22
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Reference
marvin8/taibai!23
No description provided.