deps: pin python-dotenv >=1.2.2 (CVE-2026-28684)#51
Conversation
Transitive dependency (via pydantic-settings/uvicorn[standard]) was being resolved to 1.0.1, which pip-audit now flags. Pinning directly at the floor of the fixed version. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
CI's pip-audit reads requirements.lock; the floor pin in requirements.txt alone doesn't affect the audited lock. Updating the lock entry directly. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: aa81eed591
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| pydantic>=2,<3 | ||
| pydantic-settings>=2,<3 | ||
| slowapi>=0.1,<1 | ||
| python-dotenv>=1.2.2,<2 |
There was a problem hiding this comment.
This pin in requirements.txt does not actually change what gets audited or deployed, because both the security workflow (pip-audit -r requirements.lock in .github/workflows/ci.yml) and the container build (pip install -r requirements.lock in Dockerfile) consume requirements.lock, which still contains python-dotenv==1.0.1. As a result, the CVE fix is ineffective in production and the security job can remain blocked until the lockfile is updated to include a safe version.
Useful? React with 👍 / 👎.
1 participant
Summary
python-dotenvto>=1.2.2,<2to fix CVE-2026-28684.1.0.1viapydantic-settings/uvicorn[standard]; pip-audit started flagging this and is blocking the open dependabot PRs.Test plan
securityjob passes (pip-audit clean)🤖 Generated with Claude Code