Skip to content

fix: bump requests, black, pytest#291

Open
msweier wants to merge 1 commit into
mainfrom
fix/github_vulnr
Open

fix: bump requests, black, pytest#291
msweier wants to merge 1 commit into
mainfrom
fix/github_vulnr

Conversation

@msweier

@msweier msweier commented Jun 10, 2026

Copy link
Copy Markdown
Collaborator
  • Bump requests to ^2.32.4 (Python 3.9) / ^2.33.0 (Python 3.10+) to fix .netrc credential leak and insecure temp file reuse
  • Bump black to ^25.1.0 (Python 3.9) / ^26.3.1 (Python 3.10+) to fix ReDoS and arbitrary cache file write
  • Bump pytest to ^8.3.5 (Python 3.9) / ^9.0.3 (Python 3.10+) to fix vulnerable tmpdir handling
  • Use Poetry version-conditional dependencies to apply max fixes on Python 3.10+ while maintaining 3.9 compatibility
  • Regenerate poetry.lock

…es with python version constraints to maintain 3.9 support
@msweier msweier requested a review from Enovotny June 10, 2026 16:25
@msweier msweier changed the title bump requests, black, and pytest to fix GitHub security vulnerabiliti… fix: bump requests, black, pytest Jun 10, 2026
@sonarqubecloud

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant