Repository navigation
security: refresh vulnerable dependencies and verify frozen installs - #17
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates the locked versions of anyio, cryptography, idna, urllib3, virtualenv, and Werkzeug beyond the affected ranges in the 14 open Dependabot alerts recorded on October 18. Required transitive updates are included.
CI now installs and tests the frozen lockfile with the dev extra, fails when no tests are collected, pins existing Actions to verified commit SHAs, and avoids persisting checkout credentials.
Validation: 449 tests passed, one existing skip; Ruff lint and formatting passed; workflow YAML and immutable pins checked; locked versions checked against all 14 recorded alert ranges. An initial direct pytest invocation lacked the virtualenv PATH needed by shell-hook tests; the documented uv invocation passed the complete suite.
This consolidates the dependency fixes proposed separately in #13, #14, #15, and #16 and includes the remaining cryptography/idna fixes. Alert closure must be verified after GitHub refreshes the default-branch dependency graph.