security: remediate dependency vulnerabilities #1

Merged

mig5 merged 1 commit from security/grype-dependency-fixes into main

2026-09-22 00:34:30 -05:00

security-bot commented

2026-09-21 22:44:22 -05:00

Collaborator

Automated dependency security remediation

This pull request was generated by the scheduled Forgejo dependency-security workflow.
Syft created a Python dependency SBOM from the repository (including poetry.lock), Grype scanned that SBOM, and Poetry was asked to re-resolve only packages for which Grype reported an available fix.

The workflow does not widen dependency constraints in pyproject.toml. If a safe version cannot be selected inside the existing constraints, the workflow leaves that decision for a maintainer instead of changing policy automatically.

Findings before update: 5
Fixable findings before update: 5
Findings after update: 0
Fixable findings after update: 0
Targeted Poetry packages: idna, pygments, requests, urllib3

Remediated findings

Package	Installed	Vulnerability	Severity	Fix
`idna`	`3.11`	`GHSA-65pc-fj4g-8rjx`	Medium	3.15
`pygments`	`2.19.2`	`GHSA-5239-wwwm-4pmq`	Low	2.20.0
`requests`	`2.32.5`	`GHSA-gc5v-m9x4-r6x2`	Medium	2.33.0
`urllib3`	`2.6.3`	`GHSA-mf9v-mfxr-j63j`	High	2.7.0
`urllib3`	`2.6.3`	`GHSA-qccp-gfcp-xxvc`	High	2.7.0

Remaining findings after the lockfile update

None.

Validation

The workflow re-ran Syft and Grype against the updated lockfile and ran poetry check --lock before pushing this branch.

## Automated dependency security remediation This pull request was generated by the scheduled Forgejo dependency-security workflow. Syft created a Python dependency SBOM from the repository (including `poetry.lock`), Grype scanned that SBOM, and Poetry was asked to re-resolve only packages for which Grype reported an available fix. The workflow **does not widen dependency constraints in `pyproject.toml`**. If a safe version cannot be selected inside the existing constraints, the workflow leaves that decision for a maintainer instead of changing policy automatically. - Findings before update: **5** - Fixable findings before update: **5** - Findings after update: **0** - Fixable findings after update: **0** - Targeted Poetry packages: `idna`, `pygments`, `requests`, `urllib3` ### Remediated findings | Package | Installed | Vulnerability | Severity | Fix | | --- | --- | --- | --- | --- | | `idna` | `3.11` | `GHSA-65pc-fj4g-8rjx` | Medium | 3.15 | | `pygments` | `2.19.2` | `GHSA-5239-wwwm-4pmq` | Low | 2.20.0 | | `requests` | `2.32.5` | `GHSA-gc5v-m9x4-r6x2` | Medium | 2.33.0 | | `urllib3` | `2.6.3` | `GHSA-mf9v-mfxr-j63j` | High | 2.7.0 | | `urllib3` | `2.6.3` | `GHSA-qccp-gfcp-xxvc` | High | 2.7.0 | ### Remaining findings after the lockfile update _None._ ### Validation The workflow re-ran Syft and Grype against the updated lockfile and ran `poetry check --lock` before pushing this branch.

security-bot added 1 commit

2026-09-21 22:44:22 -05:00