Skip to content

Commit d7445a4

Browse files
jvanderaajvanderaa
committed
Pin security floors for lxml, urllib3, requests, pygments
Resolved five open Dependabot advisories by adding minimum-version constraints to pyproject.toml so Poetry resolves transitive deps to patched releases: - lxml >=6.1.0 (XXE in iterparse default configuration) - urllib3 >=2.7.0 (sensitive-header forwarding on proxied redirects; decompression-bomb safeguard bypass) - requests >=2.33.0 (insecure temp file reuse in extract_zipped_paths) - pygments >=2.20.0 (ReDoS in GUID regex matching) Regenerated poetry.lock; only the four flagged packages changed.
1 parent 4547d88 commit d7445a4

3 files changed

Lines changed: 159 additions & 163 deletions

File tree

‎changes/415.security‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Bumped `lxml` (>=6.1.0), `urllib3` (>=2.7.0), `requests` (>=2.33.0), and `pygments` (>=2.20.0) to address open Dependabot advisories (XXE in iterparse, sensitive-header forwarding on proxied redirects, decompression-bomb safeguard bypass, insecure temp file reuse, ReDoS).

0 commit comments

Comments
 (0)