Commit 6210270
security: bump vulnerable deps and repair malformed pyproject.toml (#36)
Fixes 10 open Dependabot alerts and restores parseable TOML syntax.
The previous pyproject.toml contained invalid version specifiers
(`"httpx>=">=0.28.1"`) injected by a prior automated fix. Six dependency
lines had a stray `>="` mid-string, leaving the manifest unparseable.
Dependency bumps (target = lowest patched version per advisory):
- urllib3: 2.5.0 -> 2.7.0 (CVE-2026-44431, CVE-2026-44432) HIGH
- python-multipart: 0.0.26 -> 0.0.27 (CVE-2026-42561, CVE-2026-40347) HIGH/MED
- cryptography: 46.0.6 -> 46.0.7 (CVE-2026-39892, CVE-2026-34073) MED/LOW
- requests: 2.33.0 -> (CVE-2026-25645) MED
- python-dotenv: 1.2.2 -> (CVE-2026-28684) MED
- Pygments: 2.20.0 -> (CVE-2026-4539) LOW
- idna: (new) >= 3.15 (CVE-2026-45409) MED
Resolved via `uv lock` against Python 3.12:
- cryptography 48.0.0, idna 3.16, urllib3 2.7.0, requests 2.34.2,
python-multipart 0.0.29, pygments 2.20.0, python-dotenv 1.2.2.
Supersedes the four duplicate auto-generated PRs (#27-#30, all empty),
the Copilot PR whose diff did not match its description (#13), and the
narrower git-steer PR #24. Dependabot's individual-dep PRs (#14, #16,
#17, #18, #19) will auto-close once main carries the fixed versions.
Co-authored-by: ry-ops <ryan.dahlberg@gmail.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>1 parent 8dcba01 commit 6210270
2 files changed
Lines changed: 86 additions & 75 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1 | 1 | | |
2 | 2 | | |
3 | | - | |
| 3 | + | |
4 | 4 | | |
5 | 5 | | |
6 | 6 | | |
7 | 7 | | |
8 | | - | |
| 8 | + | |
9 | 9 | | |
10 | | - | |
11 | | - | |
| 10 | + | |
| 11 | + | |
12 | 12 | | |
13 | 13 | | |
14 | | - | |
15 | | - | |
16 | | - | |
17 | | - | |
18 | | - | |
| 14 | + | |
| 15 | + | |
| 16 | + | |
| 17 | + | |
| 18 | + | |
| 19 | + | |
0 commit comments