Skip to content

fix(dependabot): Resolve Security Alerts#159

Merged
lukeroantreeONS merged 1 commit intomainfrom
158-dependabot-alerts
Mar 27, 2026
Merged

fix(dependabot): Resolve Security Alerts#159
lukeroantreeONS merged 1 commit intomainfrom
158-dependabot-alerts

Conversation

@lukeroantreeONS
Copy link
Copy Markdown
Contributor

@lukeroantreeONS lukeroantreeONS commented Mar 27, 2026

📌 Resolves several security alerts surrounding transitive dependencies

✨ Summary

Dependabot flagged several alerts. Some did not impact us and have been closed.
This PR changes the minimum google-genai package version we specify, which follows through to allow tornado and pyasn1 dependencies to upgrade to the required patched versions.

📜 Changes Introduced

  • chore(pyproject.toml): update google-genai version

✅ Checklist

Please confirm you've completed these checks before requesting a review.

  • Code passes linting with Ruff
  • Security checks pass using Bandit
  • API and Unit tests are written and pass using pytest
  • Terraform files (if applicable) follow best practices and have been validated (terraform fmt & terraform validate)
  • DocStrings follow Google-style and are added as per Pylint recommendations
  • Documentation has been updated if needed

🔍 How to Test

Run uv lock; uv sync
Run uv build - confirm builds correctly.
Run through the AI notebook to confirm no issues with GCP interactions as a result of the update

Extra points; check the updated uv.lock file to confirm tornado and pyasn1 are now suitable versions (see Dependabot alerts)
Handy command for checking this;

uv tree | grep --color=always -E 'tornado|pyasn1|$'

@lukeroantreeONS lukeroantreeONS requested a review from a team as a code owner March 27, 2026 15:33
@lukeroantreeONS lukeroantreeONS linked an issue Mar 27, 2026 that may be closed by this pull request
@github-actions github-actions Bot added the bug Something isn't working label Mar 27, 2026
Copy link
Copy Markdown
Contributor

@frayle-ons frayle-ons left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM and checked lock file

@lukeroantreeONS lukeroantreeONS merged commit ae60231 into main Mar 27, 2026
5 checks passed
@lukeroantreeONS lukeroantreeONS deleted the 158-dependabot-alerts branch March 27, 2026 15:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Dependabot Alerts

2 participants