Skip to content

Commit 5627944

Browse files
asheshvasheshv
authored
chore(deps): bump JavaScript and Python third-party dependencies (#10023)
Combined fix for 8 packages flagged by GitHub Dependabot (collapsing 6 of them from open dependabot bump PRs and 4 from transitive vulnerabilities with no existing PR). All eight are transitive — no direct dep changes — so we override via `resolutions` in web/package.json and let yarn collapse duplicate-version entries during install. Resolved (pre → post via resolution): Runtime: ws 8.20.0 -> 8.21.0 (patched 8.20.1) Dev: @xmldom/xmldom 0.7.13 -> 0.8.13 (patched 0.8.13) serialize-javascript 6.0.2, 7.0.5 -> 7.0.5 (patched 7.0.5) ip-address 10.1.0, 10.2.0 -> 10.2.0 (patched 10.1.1) postcss 8.5.8, 8.5.15 -> 8.5.15 (patched 8.5.10) qs 6.15.0 -> 6.15.2 (patched 6.15.2) @tootallnate/once 2.0.0 -> 2.0.1 (patched 2.0.1) tar (7.x lineage) 7.5.13 -> 7.5.16 (patched 7.5.11) The tar 6.2.1 lineage (consumed via ^6.1.2/^6.1.11) is unaffected by these CVEs (alert ranges are 7.x-only), so the resolution is scoped `tar@npm:^7.5.4` to leave it on 6.2.1. Supersedes open dependabot PRs #9956 (ws), #9962 (tar), #9966 (@tootallnate/once), and #9974 (qs) — one CI cycle instead of four. Verification: - yarn install — clean (only pre-existing peer-dep warnings about @mui/system, aspen-core, eve, etc.; no new ones) - yarn run test:js-once — 824 / 824 pass across 140 test suites - yarn run bundle:dev — webpack compiled successfully - All 8 packages confirmed at safe versions via lockfile audit; duplicate entries collapsed (yarn.lock net -64 lines) Out of scope (cannot fix here): - paramiko (#276 #278): no patched version exists; bump-to-5.0.0 PRs #9927/#9930 audited 2026-05-20 and deferred to Q4 2026 over SSH bastion compat risk - elliptic (#176): no patched version, dev-only, low severity - flatted (#224): alert is stale; lockfile already at 3.4.2 (patched); will auto-dismiss on next dependabot rescan * chore(deps): bump Python deps to latest 3.9-compatible Picks up five Python dependency bumps that are 3.9-safe (still resolve under Python 3.9 per PyPI requires_python). Four supersede open dependabot PRs: - certifi 2026.4.22 -> 2026.5.20 (no gate; CA bundle refresh; supersedes dependabot #9977 / #9979) - typer 0.25.* -> 0.26.* (py > 3.9 row only; supersedes dependabot #9995 / #9999) - testscenarios 0.6.1 -> 0.6.2 (py > 3.9 row only; supersedes dependabot #9980) - urllib3 2.6.* -> 2.7.* (py > 3.9 row only) Picks up two HIGH-severity security fixes in urllib3 2.7.0 (2026-05-07): GHSA-mf9v-mfxr-j63j (decompression-bomb safeguards bypassed under drain_conn / Brotli stream patterns) and GHSA-qccp-gfcp-xxvc (ProxyManager.connection_from_url did not strip sensitive headers on cross-host redirects). 2.7.0 requires Python >=3.10, which the existing 'python_version > 3.9' gate already enforces. - Flask-Security-Too 5.4.* -> 5.6.* (py <= 3.9 row only) Closes a roughly 2-year gap between the 3.9 row (last pin from March 2024) and the py > 3.9 row (already on 5.8.*). 5.5/5.6 only touched flows pgAdmin doesn't use (register V2, MFA / WebAuthn templates, username recovery/changing, secret_key rotation) and config pgAdmin overrides (default hash bcrypt->argon2 sidestepped by SECURITY_PASSWORD_HASH = 'pbkdf2_sha512'). The contract changes that mattered (LoginForm.validate -> is_active, UserMixin.is_locked hook, single-kwarg find_user) are all already exercised in production via the existing FST 5.8.* / Python 3.10+ deployments.
1 parent f8e570f commit 5627944

7 files changed

Lines changed: 54 additions & 97 deletions

File tree

‎requirements.txt‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,15 +21,15 @@ azure-mgmt-subscription==3.1.1
2121
bcrypt==5.0.*
2222
boto3==1.42.*; python_version <= '3.9'
2323
boto3==1.43.*; python_version > '3.9'
24-
certifi==2026.4.22
24+
certifi==2026.5.20
2525
cryptography==48.0.*
2626
Flask-Babel==4.0.*
2727
Flask-Compress==1.*
2828
Flask-Login==0.*
2929
Flask-Mail==0.*
3030
Flask-Migrate==4.*
3131
Flask-Paranoid==0.*
32-
Flask-Security-Too==5.4.*; python_version <= '3.9'
32+
Flask-Security-Too==5.6.*; python_version <= '3.9'
3333
Flask-Security-Too==5.8.*; python_version > '3.9'
3434
Flask-SocketIO==5.6.*
3535
Flask-SQLAlchemy==3.1.*
@@ -60,9 +60,9 @@ SQLAlchemy==2.*
6060
sqlparse==0.*
6161
sshtunnel==0.*
6262
typer[all]==0.23.*; python_version <= '3.9'
63-
typer==0.25.*; python_version > '3.9'
63+
typer==0.26.*; python_version > '3.9'
6464
urllib3==1.26.*; python_version <= '3.9'
65-
urllib3==2.6.*; python_version > '3.9'
65+
urllib3==2.7.*; python_version > '3.9'
6666
user-agents==2.2.0
6767
Werkzeug==3.1.*
6868
WTForms==3.1.*; python_version <= '3.9'

‎runtime/package.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,8 @@
1313
"packageManager": "yarn@4.9.2",
1414
"devDependencies": {
1515
"@eslint/js": "^10.0.1",
16-
"electron": "^42.1.0",
17-
"eslint": "^10.4.0",
16+
"electron": "^42.3.3",
17+
"eslint": "^10.4.1",
1818
"eslint-plugin-unused-imports": "^4.4.1",
1919
"globals": "^17.6.0"
2020
},

‎runtime/yarn.lock‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -89,13 +89,13 @@ __metadata:
8989
languageName: node
9090
linkType: hard
9191

92-
"@eslint/plugin-kit@npm:^0.7.1":
93-
version: 0.7.1
94-
resolution: "@eslint/plugin-kit@npm:0.7.1"
92+
"@eslint/plugin-kit@npm:^0.7.2":
93+
version: 0.7.2
94+
resolution: "@eslint/plugin-kit@npm:0.7.2"
9595
dependencies:
9696
"@eslint/core": "npm:^1.2.1"
9797
levn: "npm:^0.4.1"
98-
checksum: 10c0/335b0c1c46fd906cb50bd5ce442b9cee18dc44342ce35c718ba4a63d1aa51d2797f16a517b2f4fe371ccd777b6862fafb2dc8195e00e69197ef4cb17ab32c01b
98+
checksum: 10c0/aafba08077bcd6d7dde6c2e21db18086046a88f914f29971a84cac9ad2d48952ded1b293e665e523805297eff756522dafa16f0062195e2c7143dcd1d47d11ed
9999
languageName: node
100100
linkType: hard
101101

@@ -474,17 +474,17 @@ __metadata:
474474
languageName: node
475475
linkType: hard
476476

477-
"electron@npm:^42.1.0":
478-
version: 42.2.0
479-
resolution: "electron@npm:42.2.0"
477+
"electron@npm:^42.3.3":
478+
version: 42.3.3
479+
resolution: "electron@npm:42.3.3"
480480
dependencies:
481481
"@electron/get": "npm:^5.0.0"
482482
"@types/node": "npm:^24.9.0"
483483
extract-zip: "npm:^2.0.1"
484484
bin:
485485
electron: cli.js
486486
install-electron: install.js
487-
checksum: 10c0/fda91b08b1119ea2c83c59f7d46ad11569bf8f502a56eb0b7cb54eefe318c7a3d39ae132cbcaf26a8c2e043c673fdb1cde7998b134f2808f3d76dd8151d10a4e
487+
checksum: 10c0/9fdb34c23097986e4ed9f328ec36356d78481133a17fdba78312be6dddb5e513f91e727a7802f91ff7302d86f794998085ef6fbc2c2b8ae9bc2d5f8b38711759
488488
languageName: node
489489
linkType: hard
490490

@@ -606,16 +606,16 @@ __metadata:
606606
languageName: node
607607
linkType: hard
608608

609-
"eslint@npm:^10.4.0":
610-
version: 10.4.0
611-
resolution: "eslint@npm:10.4.0"
609+
"eslint@npm:^10.4.1":
610+
version: 10.4.1
611+
resolution: "eslint@npm:10.4.1"
612612
dependencies:
613613
"@eslint-community/eslint-utils": "npm:^4.8.0"
614614
"@eslint-community/regexpp": "npm:^4.12.2"
615615
"@eslint/config-array": "npm:^0.23.5"
616616
"@eslint/config-helpers": "npm:^0.6.0"
617617
"@eslint/core": "npm:^1.2.1"
618-
"@eslint/plugin-kit": "npm:^0.7.1"
618+
"@eslint/plugin-kit": "npm:^0.7.2"
619619
"@humanfs/node": "npm:^0.16.6"
620620
"@humanwhocodes/module-importer": "npm:^1.0.1"
621621
"@humanwhocodes/retry": "npm:^0.4.2"
@@ -647,7 +647,7 @@ __metadata:
647647
optional: true
648648
bin:
649649
eslint: bin/eslint.js
650-
checksum: 10c0/6bf644dc08fa5a6b23157d23a4a4638d45823d03a67da1daac8dc1085b03934fa98013efd2eac2cd6ec90fe88d36b336bdf38d5f000325f22d823a15f2031426
650+
checksum: 10c0/c5e6bb5158fb0d62f090c8e2671de5c98283bbb37a58b6d871bada63af3018e683483c96c1a92272fedc8f4e5279a273a0451acf0da67c487406639daa05aedb
651651
languageName: node
652652
linkType: hard
653653

@@ -1201,10 +1201,10 @@ __metadata:
12011201
dependencies:
12021202
"@eslint/js": "npm:^10.0.1"
12031203
axios: "npm:^1.16.1"
1204-
electron: "npm:^42.1.0"
1204+
electron: "npm:^42.3.3"
12051205
electron-context-menu: "npm:^4.1.2"
12061206
electron-store: "npm:^11.0.2"
1207-
eslint: "npm:^10.4.0"
1207+
eslint: "npm:^10.4.1"
12081208
eslint-plugin-unused-imports: "npm:^4.4.1"
12091209
globals: "npm:^17.6.0"
12101210
languageName: unknown

‎tools/requirements.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,6 @@ requests>=2.32.5,<2.33; python_version <= '3.9'
22
requests>=2.34.2; python_version > '3.9'
33
requests[security]>=2.32.5,<2.33; python_version <= '3.9'
44
requests[security]>=2.34.2; python_version > '3.9'
5-
safety>=3.7.0
5+
safety>=3.8.1
66
Sphinx==7.4.7
77
sphinxcontrib-youtube==1.5.0

‎web/package.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -157,7 +157,15 @@
157157
"zustand": "^5.0.12"
158158
},
159159
"resolutions": {
160-
"rc-resize-observer": "1.4.0"
160+
"rc-resize-observer": "1.4.0",
161+
"@xmldom/xmldom": "^0.8.13",
162+
"serialize-javascript": "^7.0.5",
163+
"ip-address": "^10.1.1",
164+
"postcss": "^8.5.10",
165+
"ws": "^8.20.1",
166+
"qs": "^6.15.2",
167+
"@tootallnate/once": "^2.0.1",
168+
"tar@npm:^7.5.4": "^7.5.15"
161169
},
162170
"scripts": {
163171
"linter": "yarn run eslint -c .eslintrc.js .",

‎web/regression/requirements.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ pycodestyle>=2.14.0
2929
python-mimeparse==2.0.0
3030
selenium==4.44.0
3131
testscenarios==0.5.0; python_version <= '3.9'
32-
testscenarios==0.6.1; python_version > '3.9'
32+
testscenarios==0.6.2; python_version > '3.9'
3333
testtools==2.7.2; python_version <= '3.9'
3434
testtools==2.9.1; python_version > '3.9'
3535
traceback2==1.4.0

‎web/yarn.lock‎

Lines changed: 22 additions & 73 deletions
Original file line numberDiff line numberDiff line change
@@ -3701,10 +3701,10 @@ __metadata:
37013701
languageName: node
37023702
linkType: hard
37033703

3704-
"@tootallnate/once@npm:2":
3705-
version: 2.0.0
3706-
resolution: "@tootallnate/once@npm:2.0.0"
3707-
checksum: 10c0/073bfa548026b1ebaf1659eb8961e526be22fa77139b10d60e712f46d2f0f05f4e6c8bec62a087d41088ee9e29faa7f54838568e475ab2f776171003c3920858
3704+
"@tootallnate/once@npm:^2.0.1":
3705+
version: 2.0.1
3706+
resolution: "@tootallnate/once@npm:2.0.1"
3707+
checksum: 10c0/23b01a341485be711c602077936d70f8e695405bb88ab4433dc6d1e6cb4556401518789574d399eded790b70b27738136c9a8f02df7ae4219f4ba28bb22d586b
37083708
languageName: node
37093709
linkType: hard
37103710

@@ -4522,10 +4522,10 @@ __metadata:
45224522
languageName: node
45234523
linkType: hard
45244524

4525-
"@xmldom/xmldom@npm:^0.7.2":
4526-
version: 0.7.13
4527-
resolution: "@xmldom/xmldom@npm:0.7.13"
4528-
checksum: 10c0/cb02e4e8d986acf18578a5f25d1bce5e18d08718f40d8a0cdd922a4c112c8e00daf94de4e43f9556ed147c696b135f2ab81fa9a2a8a0416f60af15d156b60e40
4525+
"@xmldom/xmldom@npm:^0.8.13":
4526+
version: 0.8.13
4527+
resolution: "@xmldom/xmldom@npm:0.8.13"
4528+
checksum: 10c0/06405ee6fffba631abf715a305ace338420ebcea8baf1317f19f2752f5c505952b7df45159908e7be8451a42faa54326b780616ab4d08242b20477b2973da24b
45294529
languageName: node
45304530
linkType: hard
45314531

@@ -8760,13 +8760,6 @@ __metadata:
87608760
languageName: node
87618761
linkType: hard
87628762

8763-
"ip-address@npm:^10.0.1":
8764-
version: 10.1.0
8765-
resolution: "ip-address@npm:10.1.0"
8766-
checksum: 10c0/0103516cfa93f6433b3bd7333fa876eb21263912329bfa47010af5e16934eeeff86f3d2ae700a3744a137839ddfad62b900c7a445607884a49b5d1e32a3d7566
8767-
languageName: node
8768-
linkType: hard
8769-
87708763
"ip-address@npm:^10.1.1":
87718764
version: 10.2.0
87728765
resolution: "ip-address@npm:10.2.0"
@@ -10899,15 +10892,6 @@ __metadata:
1089910892
languageName: node
1090010893
linkType: hard
1090110894

10902-
"nanoid@npm:^3.3.11":
10903-
version: 3.3.11
10904-
resolution: "nanoid@npm:3.3.11"
10905-
bin:
10906-
nanoid: bin/nanoid.cjs
10907-
checksum: 10c0/40e7f70b3d15f725ca072dfc4f74e81fcf1fbb02e491cf58ac0c79093adc9b0a73b152bcde57df4b79cd097e13023d7504acb38404a4da7bc1cd8e887b82fe0b
10908-
languageName: node
10909-
linkType: hard
10910-
1091110895
"nanoid@npm:^3.3.12":
1091210896
version: 3.3.12
1091310897
resolution: "nanoid@npm:3.3.12"
@@ -11988,18 +11972,7 @@ __metadata:
1198811972
languageName: node
1198911973
linkType: hard
1199011974

11991-
"postcss@npm:^8.4.40":
11992-
version: 8.5.8
11993-
resolution: "postcss@npm:8.5.8"
11994-
dependencies:
11995-
nanoid: "npm:^3.3.11"
11996-
picocolors: "npm:^1.1.1"
11997-
source-map-js: "npm:^1.2.1"
11998-
checksum: 10c0/dd918f7127ee7c60a0295bae2e72b3787892296e1d1c3c564d7a2a00c68d8df83cadc3178491259daa19ccc54804fb71ed8c937c6787e08d8bd4bedf8d17044c
11999-
languageName: node
12000-
linkType: hard
12001-
12002-
"postcss@npm:^8.5.14":
11975+
"postcss@npm:^8.5.10":
1200311976
version: 8.5.15
1200411977
resolution: "postcss@npm:8.5.15"
1200511978
dependencies:
@@ -12144,12 +12117,12 @@ __metadata:
1214412117
languageName: node
1214512118
linkType: hard
1214612119

12147-
"qs@npm:^6.12.3":
12148-
version: 6.15.0
12149-
resolution: "qs@npm:6.15.0"
12120+
"qs@npm:^6.15.2":
12121+
version: 6.15.2
12122+
resolution: "qs@npm:6.15.2"
1215012123
dependencies:
1215112124
side-channel: "npm:^1.1.0"
12152-
checksum: 10c0/ff341078a78a991d8a48b4524d52949211447b4b1ad907f489cac0770cbc346a28e47304455c0320e5fb000f8762d64b03331e3b71865f663bf351bcba8cdb4b
12125+
checksum: 10c0/e6fd5f6f0aab06d480fe9ab15cebfc4ce4235303e2f91dc69a8f7f4df1e668a61c11d1cfbabacf4295cbbeb7b670ed23db45307480726259761f98e5695e93a7
1215312126
languageName: node
1215412127
linkType: hard
1215512128

@@ -13278,16 +13251,7 @@ __metadata:
1327813251
languageName: node
1327913252
linkType: hard
1328013253

13281-
"serialize-javascript@npm:^6.0.2":
13282-
version: 6.0.2
13283-
resolution: "serialize-javascript@npm:6.0.2"
13284-
dependencies:
13285-
randombytes: "npm:^2.1.0"
13286-
checksum: 10c0/2dd09ef4b65a1289ba24a788b1423a035581bef60817bea1f01eda8e3bda623f86357665fe7ac1b50f6d4f583f97db9615b3f07b2a2e8cbcb75033965f771dd2
13287-
languageName: node
13288-
linkType: hard
13289-
13290-
"serialize-javascript@npm:^7.0.3":
13254+
"serialize-javascript@npm:^7.0.5":
1329113255
version: 7.0.5
1329213256
resolution: "serialize-javascript@npm:7.0.5"
1329313257
checksum: 10c0/7b7818e5267f6d474ec7a56d36ba69dd712726a13eab37706ec94615fb7ca8945471f2b7fb0dc9dbe8c79c1930c1079d97f66f91315c8c8c2ca6c38898cec96f
@@ -14311,16 +14275,16 @@ __metadata:
1431114275
languageName: node
1431214276
linkType: hard
1431314277

14314-
"tar@npm:^7.5.4":
14315-
version: 7.5.13
14316-
resolution: "tar@npm:7.5.13"
14278+
"tar@npm:^7.5.15":
14279+
version: 7.5.16
14280+
resolution: "tar@npm:7.5.16"
1431714281
dependencies:
1431814282
"@isaacs/fs-minipass": "npm:^4.0.0"
1431914283
chownr: "npm:^3.0.0"
1432014284
minipass: "npm:^7.1.2"
1432114285
minizlib: "npm:^3.1.0"
1432214286
yallist: "npm:^5.0.0"
14323-
checksum: 10c0/5c65b8084799bde7a791593a1c1a45d3d6ee98182e3700b24c247b7b8f8654df4191642abbdb07ff25043d45dcff35620827c3997b88ae6c12040f64bed5076b
14287+
checksum: 10c0/4f37f3c4bd2ca2755fd736a5df1d573c1a868ec1b1e893346aeafa95ac510f9e2fd1469420bd866cc7904799e5bd4ac62b5d4f03fe27747d6e1e373b44505c5c
1432414288
languageName: node
1432514289
linkType: hard
1432614290

@@ -15461,24 +15425,9 @@ __metadata:
1546115425
languageName: node
1546215426
linkType: hard
1546315427

15464-
"ws@npm:^8.18.0, ws@npm:^8.19.0":
15465-
version: 8.20.0
15466-
resolution: "ws@npm:8.20.0"
15467-
peerDependencies:
15468-
bufferutil: ^4.0.1
15469-
utf-8-validate: ">=5.0.2"
15470-
peerDependenciesMeta:
15471-
bufferutil:
15472-
optional: true
15473-
utf-8-validate:
15474-
optional: true
15475-
checksum: 10c0/956ac5f11738c914089b65878b9223692ace77337ba55379ae68e1ecbeae9b47a0c6eb9403688f609999a58c80d83d99865fe0029b229d308b08c1ef93d4ea14
15476-
languageName: node
15477-
linkType: hard
15478-
15479-
"ws@npm:~8.18.3":
15480-
version: 8.18.3
15481-
resolution: "ws@npm:8.18.3"
15428+
"ws@npm:^8.20.1":
15429+
version: 8.21.0
15430+
resolution: "ws@npm:8.21.0"
1548215431
peerDependencies:
1548315432
bufferutil: ^4.0.1
1548415433
utf-8-validate: ">=5.0.2"
@@ -15487,7 +15436,7 @@ __metadata:
1548715436
optional: true
1548815437
utf-8-validate:
1548915438
optional: true
15490-
checksum: 10c0/eac918213de265ef7cb3d4ca348b891a51a520d839aa51cdb8ca93d4fa7ff9f6ccb339ccee89e4075324097f0a55157c89fa3f7147bde9d8d7e90335dc087b53
15439+
checksum: 10c0/ef4a243476283fc49bc7550966c4af4aa0eef56273837211e700de3b664e08604a760cdddcb5ba43c049140e74ccfec5b0ee0bb439e08c2adf9138902fdde5f9
1549115440
languageName: node
1549215441
linkType: hard
1549315442

0 commit comments

Comments
 (0)