From 979f9bd7154f08bcd08e6e5a35a1ac04d2fadc75 Mon Sep 17 00:00:00 2001 From: itswl Date: Mon, 26 Oct 2026 17:10:53 +0800 Subject: [PATCH 1/2] =?UTF-8?q?deps:=20filelock=204.2.4=20=E2=80=94=20thre?= =?UTF-8?q?e=20advisories=20published=20since=20the=20last=20lock?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CVE-2026-112940, CVE-2026-112913 and CVE-2026-112907, all fixed in filelock 4.2.1, turned the gate red at pip-audit; every service's lock carried 3.32.3, main included. filelock reaches the venvs only through pip-audit's own HTTP cache (cachecontrol[filecache], filelock>=3.8.0, no upper bound), and the images install runtime packages only, so no published image carries it. 4.2.4 is the newest release from the project's own release flow; installed into each venv, the locks regenerated by scripts/relock.sh, and filelock is the only pin that moved. STACK GATE GREEN. --- hookjudge/requirements.lock | 2 +- hookprobe/requirements.lock | 2 +- hookrelay/requirements.lock | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/hookjudge/requirements.lock b/hookjudge/requirements.lock index 4a3f935d..1899743c 100644 --- a/hookjudge/requirements.lock +++ b/hookjudge/requirements.lock @@ -13,7 +13,7 @@ coverage==7.16.2 cyclonedx-python-lib==11.12.0 defusedxml==0.7.1 fastapi==0.161.1 -filelock==3.32.3 +filelock==4.2.4 h11==0.16.0 httpcore==1.0.9 httptools==0.8.0 diff --git a/hookprobe/requirements.lock b/hookprobe/requirements.lock index 64f44e4b..9c98c403 100644 --- a/hookprobe/requirements.lock +++ b/hookprobe/requirements.lock @@ -16,7 +16,7 @@ cryptography==50.0.0 cyclonedx-python-lib==11.12.0 defusedxml==0.7.1 fastapi==0.141.1 -filelock==3.32.3 +filelock==4.2.4 h11==0.16.0 httpcore==1.0.9 httpcore2==2.12.0 diff --git a/hookrelay/requirements.lock b/hookrelay/requirements.lock index dc6ac900..177a244d 100644 --- a/hookrelay/requirements.lock +++ b/hookrelay/requirements.lock @@ -13,7 +13,7 @@ coverage==7.16.2 cyclonedx-python-lib==11.12.0 defusedxml==0.7.1 fastapi==0.161.1 -filelock==3.32.3 +filelock==4.2.4 h11==0.16.0 httpcore==1.0.9 httptools==0.8.0 From e85365dc0541c2fe66552123f31238657f8733f3 Mon Sep 17 00:00:00 2001 From: itswl Date: Mon, 26 Oct 2026 17:10:53 +0800 Subject: [PATCH 2/2] authors: map by email alone, so .mailmap stops repeating the profile display name The file mapped old author names onto the one human identity by repeating each old name, one of them the account's profile display name, which then sat in a tracked file of a public repository. The two commits GitHub authored under that display name (the merges of #1 and #5) carry the owner's email, so mapping the email alone gives log, shortlog and blame the same result without naming any old name. The second line mapped a local-machine address no commit in the history uses; it is gone. Read back: git log --use-mailmap shows the same identities before and after, one human identity plus Dependabot's one, and the two merge commits read as the owner. Nothing in the repository reads .mailmap. The history keeps the earlier file. --- .mailmap | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.mailmap b/.mailmap index 63efc7ff..c39c71cd 100644 --- a/.mailmap +++ b/.mailmap @@ -1,6 +1,6 @@ # One human identity for this repository. The raw commits made before the # identity was pinned still carry the old names; this maps them for every # git command that reads authors (log, shortlog, blame, format-patch). -# Bot commits are deliberately not mapped. -itswl WeiLai -itswl imwl +# The mapping is by email alone, so this file never has to repeat an old +# name in order to correct it. Bot commits are deliberately not mapped. +itswl