Address 3 pysentry security vulnerabilities (idna, pymdown-extensions, markdown) #20

New issue

Closed

opened 2026-05-23 01:07:51 +00:00 by coding-agent-marvin8 · 1 comment

coding-agent-marvin8 commented

2026-05-23 01:07:51 +00:00

(Migrated from codeberg.org)

Running nox -s pysentry reveals three vulnerabilities across transitive dependencies:

ID	Package	Severity	Fixable
PYSEC-2026-89	`markdown` 3.10.2	HIGH	No
GHSA-65pc-fj4g-8rjx	`idna` 3.11	MEDIUM	Yes (≥3.15)
GHSA-62q4-447f-wv8h	`pymdown-extensions` 10.21.2	MEDIUM	Yes (≥10.21.3)

None are in zaojun's own code — all are transitive dependencies pulled in via the docs toolchain or httpx.

Running `nox -s pysentry` reveals three vulnerabilities across transitive dependencies: | ID | Package | Severity | Fixable | |----|---------|----------|---------| | PYSEC-2026-89 | `markdown` 3.10.2 | HIGH | No | | GHSA-65pc-fj4g-8rjx | `idna` 3.11 | MEDIUM | Yes (≥3.15) | | GHSA-62q4-447f-wv8h | `pymdown-extensions` 10.21.2 | MEDIUM | Yes (≥10.21.3) | None are in zaojun's own code — all are transitive dependencies pulled in via the docs toolchain or `httpx`.

coding-agent-marvin8 commented

2026-05-23 01:22:18 +00:00

(Migrated from codeberg.org)

Findings

idna (GHSA-65pc-fj4g-8rjx): pulled in via httpx → idna. DoS via idna.encode() on crafted inputs; fixed in ≥3.15.

pymdown-extensions (GHSA-62q4-447f-wv8h): pulled in via mkdocs-material → pymdown-extensions. Path traversal bypass in snippets preprocessor; fixed in ≥10.21.3.

markdown (PYSEC-2026-89): pulled in by the entire docs toolchain (mkdocs, mkdocs-material, mkdocstrings). Malformed HTML-like sequences can crash HTMLParser. No fix available yet — docs-build only, not in the published package.

Plan

Add idna>=3.15 and pymdown-extensions>=10.21.3 to [tool.uv] constraint-dependencies in pyproject.toml (same pattern as existing requests/urllib3 constraints).
Run uv lock to pull updated pinned versions into uv.lock.
Add [tool.pysentry.ignore] while_no_fix = ["PYSEC-2026-89"] — pysentry auto-discovers this section; while_no_fix re-flags if a fix ever lands.
Add vuln-ignore = ["PYSEC-2026-89"] to [tool.zaojun] so zaojun'''s self-scan also suppresses the unfixable advisory.

Single commit on branch fix/issue-20-address-pysentry-vulnerabilities.

## Findings **idna** (GHSA-65pc-fj4g-8rjx): pulled in via `httpx` → `idna`. DoS via `idna.encode()` on crafted inputs; fixed in ≥3.15. **pymdown-extensions** (GHSA-62q4-447f-wv8h): pulled in via `mkdocs-material` → `pymdown-extensions`. Path traversal bypass in snippets preprocessor; fixed in ≥10.21.3. **markdown** (PYSEC-2026-89): pulled in by the entire docs toolchain (mkdocs, mkdocs-material, mkdocstrings). Malformed HTML-like sequences can crash HTMLParser. No fix available yet — docs-build only, not in the published package. ## Plan 1. Add `idna>=3.15` and `pymdown-extensions>=10.21.3` to `[tool.uv] constraint-dependencies` in `pyproject.toml` (same pattern as existing `requests`/`urllib3` constraints). 2. Run `uv lock` to pull updated pinned versions into `uv.lock`. 3. Add `[tool.pysentry.ignore] while_no_fix = ["PYSEC-2026-89"]` — pysentry auto-discovers this section; `while_no_fix` re-flags if a fix ever lands. 4. Add `vuln-ignore = ["PYSEC-2026-89"]` to `[tool.zaojun]` so zaojun'''s self-scan also suppresses the unfixable advisory. Single commit on branch `fix/issue-20-address-pysentry-vulnerabilities`.