security: remediate dependency vulnerabilities #3

Merged

mig5 merged 1 commit from security/grype-dependency-fixes into main

2026-10-21 21:15:58 -05:00

security-bot commented

2026-10-21 21:12:13 -05:00

Collaborator

Automated dependency security remediation

This pull request was generated by the scheduled Forgejo dependency-security workflow.
Syft created a Python dependency SBOM from the repository (including poetry.lock), Grype scanned that SBOM, and Poetry was asked to re-resolve only packages for which Grype reported an available fix.

The workflow does not widen dependency constraints in pyproject.toml. If a safe version cannot be selected inside the existing constraints, the workflow leaves that decision for a maintainer instead of changing policy automatically.

Findings before update: 1
Fixable findings before update: 1
Findings after update: 0
Fixable findings after update: 0
Targeted Poetry packages: certifi

Remediated findings

Package	Installed	Vulnerability	Severity	Fix
`certifi`	`2026.6.17`	`GHSA-6q48-6c7w-9gw2`	Critical	2026.10.19

Remaining findings after the lockfile update

None.

Validation

The workflow re-ran Syft and Grype against the updated lockfile and ran poetry check --lock before pushing this branch.

## Automated dependency security remediation This pull request was generated by the scheduled Forgejo dependency-security workflow. Syft created a Python dependency SBOM from the repository (including `poetry.lock`), Grype scanned that SBOM, and Poetry was asked to re-resolve only packages for which Grype reported an available fix. The workflow **does not widen dependency constraints in `pyproject.toml`**. If a safe version cannot be selected inside the existing constraints, the workflow leaves that decision for a maintainer instead of changing policy automatically. - Findings before update: **1** - Fixable findings before update: **1** - Findings after update: **0** - Fixable findings after update: **0** - Targeted Poetry packages: `certifi` ### Remediated findings | Package | Installed | Vulnerability | Severity | Fix | | --- | --- | --- | --- | --- | | `certifi` | `2026.6.17` | `GHSA-6q48-6c7w-9gw2` | Critical | 2026.10.19 | ### Remaining findings after the lockfile update _None._ ### Validation The workflow re-ran Syft and Grype against the updated lockfile and ran `poetry check --lock` before pushing this branch.

security-bot added 1 commit

2026-10-21 21:12:13 -05:00