Skip to content

Update dependency dulwich to v1 #65

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mend-for-github-com wants to merge 1 commit into
base: main
Choose a base branch
from

Update dependency dulwich to v1

830039c
Select commit
Loading
Failed to load commit list.
Open

Update dependency dulwich to v1 #65

Update dependency dulwich to v1
830039c
Select commit
Loading
Failed to load commit list.
Mend for GitHub.com / Mend Security Check failed Jun 4, 2026 in 9m 24s

Security Report

You have successfully remediated 11 vulnerabilities, but introduced 9 new vulnerabilities in this branch.

❌ New vulnerabilities:

Vulnerability Severity CVSS Score Vulnerable Library Direct Library Suggested Fix Issue
CVE-2026-31958

Path to dependency file: /data-files/benchmarks/bm_tornado_http/requirements.txt

Path to vulnerable library: /tmp/ws-ua_20260604190457_RNSOVE/python_YSQEAU/20260604190458/tornado-6.1.tar.gz

Dependency Hierarchy:

-> ❌ tornado-6.1.tar.gz (Vulnerable Library)

High 7.5 Direct tornado-6.1.tar.gz tornado-6.1.tar.gz 6.5.5 None
CVE-2025-67726

Path to dependency file: /data-files/benchmarks/bm_tornado_http/requirements.txt

Path to vulnerable library: /tmp/ws-ua_20260604190457_RNSOVE/python_YSQEAU/20260604190458/tornado-6.1.tar.gz

Dependency Hierarchy:

-> ❌ tornado-6.1.tar.gz (Vulnerable Library)

High 7.5 Direct tornado-6.1.tar.gz tornado-6.1.tar.gz 6.5.3 None
CVE-2025-67725

Path to dependency file: /data-files/benchmarks/bm_tornado_http/requirements.txt

Path to vulnerable library: /tmp/ws-ua_20260604190457_RNSOVE/python_YSQEAU/20260604190458/tornado-6.1.tar.gz

Dependency Hierarchy:

-> ❌ tornado-6.1.tar.gz (Vulnerable Library)

High 7.5 Direct tornado-6.1.tar.gz tornado-6.1.tar.gz 6.5.3 None
CVE-2025-47287

Path to dependency file: /data-files/benchmarks/bm_tornado_http/requirements.txt

Path to vulnerable library: /tmp/ws-ua_20260604190457_RNSOVE/python_YSQEAU/20260604190458/tornado-6.1.tar.gz

Dependency Hierarchy:

-> ❌ tornado-6.1.tar.gz (Vulnerable Library)

High 7.5 Direct tornado-6.1.tar.gz tornado-6.1.tar.gz 6.5 None
CVE-2024-52804

Path to dependency file: /data-files/benchmarks/bm_tornado_http/requirements.txt

Path to vulnerable library: /tmp/ws-ua_20260604190457_RNSOVE/python_YSQEAU/20260604190458/tornado-6.1.tar.gz

Dependency Hierarchy:

-> ❌ tornado-6.1.tar.gz (Vulnerable Library)

High 7.5 Direct tornado-6.1.tar.gz tornado-6.1.tar.gz tornado - 6.4.2 None
CVE-2026-35536

Path to dependency file: /data-files/benchmarks/bm_tornado_http/requirements.txt

Path to vulnerable library: /tmp/ws-ua_20260604190457_RNSOVE/python_YSQEAU/20260604190458/tornado-6.1.tar.gz

Dependency Hierarchy:

-> ❌ tornado-6.1.tar.gz (Vulnerable Library)

High 7.2 Direct tornado-6.1.tar.gz tornado-6.1.tar.gz 6.5.5 None
CVE-2023-28370

Path to dependency file: /data-files/benchmarks/bm_tornado_http/requirements.txt

Path to vulnerable library: /tmp/ws-ua_20260604190457_RNSOVE/python_YSQEAU/20260604190458/tornado-6.1.tar.gz

Dependency Hierarchy:

-> ❌ tornado-6.1.tar.gz (Vulnerable Library)

Medium 6.1 Direct tornado-6.1.tar.gz tornado-6.1.tar.gz tornado - 6.3.2 None
WS-2023-0296

Path to dependency file: /data-files/benchmarks/bm_tornado_http/requirements.txt

Path to vulnerable library: /tmp/ws-ua_20260604190457_RNSOVE/python_YSQEAU/20260604190458/tornado-6.1.tar.gz

Dependency Hierarchy:

-> ❌ tornado-6.1.tar.gz (Vulnerable Library)

Medium 5.6 Direct tornado-6.1.tar.gz tornado-6.1.tar.gz None
CVE-2025-67724

Path to dependency file: /data-files/benchmarks/bm_tornado_http/requirements.txt

Path to vulnerable library: /tmp/ws-ua_20260604190457_RNSOVE/python_YSQEAU/20260604190458/tornado-6.1.tar.gz

Dependency Hierarchy:

-> ❌ tornado-6.1.tar.gz (Vulnerable Library)

Medium 5.4 Direct tornado-6.1.tar.gz tornado-6.1.tar.gz 6.5.3 None

✔️ Remediated vulnerabilities:

Vulnerability Vulnerable Library
CVE-2026-31958 tornado-6.1-cp37-cp37m-manylinux2010_x86_64.whl
CVE-2025-67726 tornado-6.1-cp37-cp37m-manylinux2010_x86_64.whl
CVE-2025-47287 tornado-6.1-cp37-cp37m-manylinux2010_x86_64.whl
CVE-2026-42305 dulwich-0.20.23-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_12_x86_64.manylinux2010_x86_64.whl
CVE-2023-28370 tornado-6.1-cp37-cp37m-manylinux2010_x86_64.whl
CVE-2024-5569 zipp-3.11.0-py3-none-any.whl
CVE-2025-67724 tornado-6.1-cp37-cp37m-manylinux2010_x86_64.whl
WS-2023-0296 tornado-6.1-cp37-cp37m-manylinux2010_x86_64.whl
CVE-2024-52804 tornado-6.1-cp37-cp37m-manylinux2010_x86_64.whl
CVE-2026-35536 tornado-6.1-cp37-cp37m-manylinux2010_x86_64.whl
CVE-2025-67725 tornado-6.1-cp37-cp37m-manylinux2010_x86_64.whl

Base branch total remaining vulnerabilities: 39
Base branch commit: null


Total libraries scanned: 40

Scan token: 8284d2a17ec7485dbd4580c3bea3dd84

View more details on Mend for GitHub.com