Repository navigation
merge master (beta.56 + Dependabot hotfix #3926) into dev - #3928
Merged
Merged
Conversation
… of #3925 for master) Same bumps as #3925 on dev, applied to master's own locks: pillow 13.0.0, aiohttp 3.14.5 (yarl 1.25.1), anyio 4.14.2, certifi 2026.10.19, fsspec 2026.9.0, urllib3 2.8.0; desktop dompurify 3.4.17, vue and @vue/server-renderer 3.5.44, source-map-js 1.2.2, undici 7.30.1, vite 8.3.0 -> 8.3.5.
The Mac build installs tinyagentos/requirements.lock with --no-deps, so it still shipped pillow 12.3.0, aiohttp 3.14.1, anyio 4.13.0, certifi 2026.4.22, fsspec 2026.3.0 and urllib3 2.7.0. Upgrade only those six (pins aligned to uv.lock) and add the pypdf, python-slugify, tenacity and yt-dlp pins the lock was missing against pyproject.
…261023 hotfix(deps): clear open high/critical Dependabot alerts on master (same bumps as #3925)
desktop/package-lock.json: kept dev's lock; it already carries dompurify 3.4.17, vue 3.5.44, vite 8.3.5, undici 7.30.1 and source-map-js 1.2.2 from #3925, and master's lock predates dev's package.json.
|
ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Back-merge of master after the Dependabot security hotfix #3926 landed on master (Jay 2026-10-23 live).
Conflict: desktop/package-lock.json, resolved by keeping dev's lock; it already carries every bump #3926 made (dompurify 3.4.17, vue 3.5.44, vite 8.3.5, undici 7.30.1, source-map-js 1.2.2 via #3925) and master's lock predates dev's package.json. uv.lock auto-merged.