fix: address pysentry vulnerabilities (idna, pymdown-extensions, markdown) #21

Merged

coding-agent-marvin8 merged 0 commits from fix/issue-20-address-pysentry-vulnerabilities into main

2026-05-23 01:52:48 +00:00

coding-agent-marvin8 commented

2026-05-23 01:24:16 +00:00

(Migrated from codeberg.org)

Closes #20

Summary

Pin idna>=3.15 (→ resolved 3.16) via constraint-dependencies — fixes GHSA-65pc-fj4g-8rjx (DoS in idna.encode())
Pin pymdown-extensions>=10.21.3 via constraint-dependencies — fixes GHSA-62q4-447f-wv8h (path traversal bypass in snippets)
Ignore PYSEC-2026-89 (markdown, no fix available) via [tool.pysentry.ignore] while_no_fix and [tool.zaojun] vuln-ignore — both will re-alert automatically when a fix lands

Test plan

uv run nox -s pysentry exits 0 with "0 vulnerabilities found"
uv run nox -s dependency_versions does not report PYSEC-2026-89

Closes #20 ## Summary - Pin `idna>=3.15` (→ resolved 3.16) via `constraint-dependencies` — fixes GHSA-65pc-fj4g-8rjx (DoS in `idna.encode()`) - Pin `pymdown-extensions>=10.21.3` via `constraint-dependencies` — fixes GHSA-62q4-447f-wv8h (path traversal bypass in snippets) - Ignore `PYSEC-2026-89` (`markdown`, no fix available) via `[tool.pysentry.ignore] while_no_fix` and `[tool.zaojun] vuln-ignore` — both will re-alert automatically when a fix lands ## Test plan - [ ] `uv run nox -s pysentry` exits 0 with "0 vulnerabilities found" - [ ] `uv run nox -s dependency_versions` does not report PYSEC-2026-89