security: remediate dependency vulnerabilities #3

Merged

mig5 merged 1 commit from security/grype-dependency-fixes into main

2026-10-03 02:19:53 -05:00

security-bot commented

2026-10-02 20:48:38 -05:00

Collaborator

Automated dependency security remediation

This pull request was generated by the scheduled Forgejo dependency-security workflow.
Syft created a Python dependency SBOM from the repository (including poetry.lock), Grype scanned that SBOM, and Poetry was asked to re-resolve only packages for which Grype reported an available fix.

The workflow does not widen dependency constraints in pyproject.toml. If a safe version cannot be selected inside the existing constraints, the workflow leaves that decision for a maintainer instead of changing policy automatically.

Findings before update: 3
Fixable findings before update: 3
Findings after update: 0
Fixable findings after update: 0
Targeted Poetry packages: urllib3

Remediated findings

Package	Installed	Vulnerability	Severity	Fix
`urllib3`	`2.7.0`	`GHSA-8988-9cw3-xx77`	High	2.8.0
`urllib3`	`2.7.0`	`GHSA-gh4c-6fx4-qh6g`	Medium	2.8.0
`urllib3`	`2.7.0`	`GHSA-vxq7-64xx-v4gw`	High	2.8.0

Remaining findings after the lockfile update

None.

Validation

The workflow re-ran Syft and Grype against the updated lockfile and ran poetry check --lock before pushing this branch.

## Automated dependency security remediation This pull request was generated by the scheduled Forgejo dependency-security workflow. Syft created a Python dependency SBOM from the repository (including `poetry.lock`), Grype scanned that SBOM, and Poetry was asked to re-resolve only packages for which Grype reported an available fix. The workflow **does not widen dependency constraints in `pyproject.toml`**. If a safe version cannot be selected inside the existing constraints, the workflow leaves that decision for a maintainer instead of changing policy automatically. - Findings before update: **3** - Fixable findings before update: **3** - Findings after update: **0** - Fixable findings after update: **0** - Targeted Poetry packages: `urllib3` ### Remediated findings | Package | Installed | Vulnerability | Severity | Fix | | --- | --- | --- | --- | --- | | `urllib3` | `2.7.0` | `GHSA-8988-9cw3-xx77` | High | 2.8.0 | | `urllib3` | `2.7.0` | `GHSA-gh4c-6fx4-qh6g` | Medium | 2.8.0 | | `urllib3` | `2.7.0` | `GHSA-vxq7-64xx-v4gw` | High | 2.8.0 | ### Remaining findings after the lockfile update _None._ ### Validation The workflow re-ran Syft and Grype against the updated lockfile and ran `poetry check --lock` before pushing this branch.

security-bot added 1 commit

2026-10-02 20:48:38 -05:00