deps: clear open high/critical Dependabot alerts (Pillow 13, aiohttp, certifi, anyio, urllib3, fsspec, dompurify, vue, vite) by jaylfc · Pull Request #3925 · jaylfc/taOS

jaylfc · 2026-10-23T10:18:58Z

Clears the open high and critical Dependabot alerts on jaylfc/taOS (86 open on 10-23: 7 critical, 35 high; most of them are Pillow advisories raised today).

Python (uv.lock, uv lock --upgrade-package):

pillow 12.3.0 -> 13.0.0 (critical and high, fixed in 13.0.0)
aiohttp 3.14.3 -> 3.14.5, pulling yarl 1.24.2 -> 1.25.1 (high, fixed in 3.14.4)
anyio 4.13.0 -> 4.14.2 (critical, fixed in 4.14.2)
certifi 2026.5.20 -> 2026.10.19 (critical)
fsspec 2026.4.0 -> 2026.9.0 (high, fixed in 2026.6.0)
urllib3 2.7.0 -> 2.8.0 (high)

Desktop (desktop/package-lock.json, npm update --package-lock-only, all within existing ranges, package.json unchanged):

dompurify 3.4.16 -> 3.4.17 (critical and high)
vue and @vue/server-renderer 3.5.38 -> 3.5.44 (high, fixed in 3.5.42)
source-map-js 1.2.1 -> 1.2.2 (high)
undici 7.29.0 -> 7.30.1 (high, fixed in 7.29.1)
vite 8.3.3 -> 8.3.5 (high, fixed in 8.3.3; master still has 8.3.0)

Not fixable yet: braces 3.0.3 (pulled in by excalidraw's bundled chokidar). The advisory has no patched release.

Pillow 13 is a major version. Measured locally on Python 3.13: every test file that imports PIL (canvas render, avatar, hub posts, library, storybook and storybook PDF, project tools, images edit, sdcpp server) gives 331 passed, 2 skipped. Full suite and spa-build run in CI.

The LiteLLM critical alerts in the notification thread are the old ones (#9 to #12, raised 06-16/17, auto-fixed 06-20 when LiteLLM left the lock). uv.lock has no LiteLLM entry on dev or master.

The alerts are counted on master, so this needs to reach master too, either as a hotfix or with the next promotion.

Summary by CodeRabbit

Bug Fixes
- Updated several components used during installation to address open high- and critical-severity security advisories.
Documentation
- Added a security changelog entry listing the affected Python and desktop-build components and their updated versions, including previously unlisted Python dependency pins.

Python (uv.lock): pillow 12.3.0 -> 13.0.0, aiohttp 3.14.3 -> 3.14.5 (yarl 1.24.2 -> 1.25.1), anyio 4.13.0 -> 4.14.2, certifi 2026.5.20 -> 2026.10.19, fsspec 2026.4.0 -> 2026.9.0, urllib3 2.7.0 -> 2.8.0. Desktop (package-lock.json, in-range updates): dompurify 3.4.16 -> 3.4.17, vue and @vue/server-renderer 3.5.38 -> 3.5.44, source-map-js 1.2.1 -> 1.2.2, undici 7.29.0 -> 7.30.1, vite 8.3.3 -> 8.3.5. braces 3.0.3 (via excalidraw's chokidar) has no patched release yet.

qodo-code-review · 2026-10-23T10:19:05Z

ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing

coderabbitai · 2026-10-23T10:19:38Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Source mode: Auto
Repository: jaylfc/taOS
Branch: fix/dependabot-high-20261023
File: .coderabbit.yaml
Commit: f4b203e
Layers: Repository YAML
Review profile: CHILL
Plan: Advanced
Run ID: 481915bf-c749-458d-9007-c4b5684aea7b

📥 Commits

Reviewing files that changed from the base of the PR and between e1667cb and f4b203e.

⛔ Files ignored due to path filters: 1

tinyagentos/requirements.lock is excluded by !**/*.lock

📒 Files selected for processing: 1

changelog.d/3925-dependabot-high-bumps.md

🚧 Files skipped from review as they are similar to previous changes: 1

changelog.d/3925-dependabot-high-bumps.md

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 1 remain after this review.

📝 Walkthrough

The pull request updates seven Python dependency pins in the install constraints file. It adds a security changelog entry listing updated Python and desktop-build dependency versions.

Changes: Security dependency updates

Layer / File(s)	Summary
Update pins and record versions `scripts/install-constraints.txt`, `changelog.d/3925-dependabot-high-bumps.md`	The constraints file updates pins for seven Python dependencies. The changelog lists updated Python and desktop-build dependency versions.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Possibly related PRs

jaylfc/taOS#3926: Applies the same Python and desktop dependency bumps to master and updates the same dependency lockfile data.

Merge Risk: ⚪ Minimal · up to f4b20

No specific merge-blocking issue is established from the supplied changes; complete the normal dependency and build checks before merging.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title names the main change: clearing open high and critical Dependabot alerts by bumping dependencies. The objectives confirm this, with lockfile upgrades for Pillow, aiohttp, certifi, anyio, url…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title names the main change: clearing open high and critical Dependabot alerts by bumping dependencies. The objectives confirm this, with lockfile upgrades for Pillow, aiohttp, certifi, anyio, urllib3, fsspec, dompurify, Vue, and Vite. The title is specific and accurate. The title is long at 124 characters, but it does not fail the check.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches: 💡 1

🛠️ Fix failing CI checks: 💡

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

gitar-bot · 2026-10-23T10:19:43Z

Gitar is working

Verification

Rules No rules evaluated

Functional validation Not enabled

Set up

Auto-approval Not enabled

Set up

_Gitar

Docs-Reviewed: version pins only, regenerated with the command in test_constraints_file_matches_lock; no install step or README instruction changes.

The Mac build installs tinyagentos/requirements.lock with --no-deps, so it still shipped pillow 12.3.0, aiohttp 3.14.1, anyio 4.13.0, certifi 2026.4.22, fsspec 2026.3.0 and urllib3 2.7.0. Upgrade only those six (pins aligned to uv.lock) and add the pypdf, python-slugify, tenacity and yt-dlp pins the lock was missing against pyproject.

jaylfc · 2026-10-23T11:59:39Z

@coderabbitai review

coderabbitai · 2026-10-23T12:03:26Z

⚠️ Action not completed

Already reviewed the last commit. Use @coderabbitai full review to rerun a review of the entire changeset.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

…261023 hotfix(deps): clear open high/critical Dependabot alerts on master (same bumps as #3925)

jaylfc added 2 commits October 23, 2026 10:18

changelog: fragment for #3925 dependency security bumps

5263f91

deps: regenerate install-constraints.txt from the bumped uv.lock

e1667cb

Docs-Reviewed: version pins only, regenerated with the command in test_constraints_file_matches_lock; no install step or README instruction changes.

jaylfc mentioned this pull request Oct 23, 2026

hotfix(deps): clear open high/critical Dependabot alerts on master (same bumps as #3925) #3926

Merged

jaylfc added a commit that referenced this pull request Oct 23, 2026

Merge pull request #3926 from jaylfc/hotfix/dependabot-high-master-20…

91bf7d0

…261023 hotfix(deps): clear open high/critical Dependabot alerts on master (same bumps as #3925)

jaylfc merged commit ecfe28f into dev Oct 23, 2026
49 of 50 checks passed

jaylfc mentioned this pull request Oct 23, 2026

merge master (beta.56 + Dependabot hotfix #3926) into dev #3928

Merged

coderabbitai Bot mentioned this pull request Oct 23, 2026

release: 1.0.0-beta.57 (dependency security hotfix) #3931

Merged

Navigation Menu

Repository navigation

deps: clear open high/critical Dependabot alerts (Pillow 13, aiohttp, certifi, anyio, urllib3, fsspec, dompurify, vue, vite) - #3925

deps: clear open high/critical Dependabot alerts (Pillow 13, aiohttp, certifi, anyio, urllib3, fsspec, dompurify, vue, vite)#3925
jaylfc merged 4 commits into
devfrom
fix/dependabot-high-20261023

jaylfc commented Oct 23, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

qodo-code-review Bot commented Oct 23, 2026

Uh oh!

coderabbitai Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

gitar-bot Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

jaylfc commented Oct 23, 2026

Uh oh!

coderabbitai Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

jaylfc commented Oct 23, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

qodo-code-review Bot commented Oct 23, 2026

Uh oh!

coderabbitai Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gitar-bot Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jaylfc commented Oct 23, 2026

Uh oh!

coderabbitai Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

jaylfc commented Oct 23, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Oct 23, 2026 •

edited

Loading

gitar-bot Bot commented Oct 23, 2026 •

edited

Loading

coderabbitai Bot commented Oct 23, 2026 •

edited

Loading