[PR #152] [MERGED] [deps] Bump idna, python-dotenv and Pygments past their advisories #155

New issue

Closed

opened 2026-10-13 19:48:05 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 19:48:05 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Glitchy-Sheep/boosty-downloader/pull/152
Author: @Glitchy-Sheep
Created: 8/15/2026
Status: ✅ Merged
Merged: 8/15/2026
Merged by: @Glitchy-Sheep

Base: main ← Head: chore/bump-vulnerable-transitives

📝 Commits (1)

ec818a2 chore: Bump idna, python-dotenv and Pygments past their advisories

📊 Changes

1 file changed (+16 additions, -10 deletions)

View changed files

📝 uv.lock (+16 -10)

📄 Description

Summary

Three transitive packages in uv.lock sat inside vulnerable ranges flagged by Dependabot. This bumps them past the advisories - lockfile-only, nothing changes in pyproject.toml.

The alerts

idna 3.11 -> 3.18: CVE-2026-45409 (medium) - crafted input to idna.encode() bypassing an older fix; reachable through yarl/aiohttp host parsing
python-dotenv 1.2.1 -> 1.2.2: CVE-2026-28684 (medium) - symlink following in set_key; we never write .env files, near-zero exposure, fixed anyway
Pygments 2.19.2 -> 2.20.0: CVE-2026-4539 (low) - ReDoS in a highlighting regex; we highlight nothing user-supplied

Two more open alerts point at poetry.lock, a file removed by the uv migration - they will be dismissed by hand after this merges.

Verification

Full task ci green on the updated environment: checks, 129 unit tests, 6 live integration tests, build
Renovate stays silent on these because its vulnerability alerts cover direct dependencies only - transitive bumps go by hand

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Glitchy-Sheep/boosty-downloader/pull/152 **Author:** [@Glitchy-Sheep](https://github.com/Glitchy-Sheep) **Created:** 8/15/2026 **Status:** ✅ Merged **Merged:** 8/15/2026 **Merged by:** [@Glitchy-Sheep](https://github.com/Glitchy-Sheep) **Base:** `main` ← **Head:** `chore/bump-vulnerable-transitives` --- ### 📝 Commits (1) - [`ec818a2`](https://github.com/Glitchy-Sheep/boosty-downloader/commit/ec818a2b16193a1b7c5887db2445431ed5c35b9d) chore: Bump idna, python-dotenv and Pygments past their advisories ### 📊 Changes **1 file changed** (+16 additions, -10 deletions) <details> <summary>View changed files</summary> 📝 `uv.lock` (+16 -10) </details> ### 📄 Description ## Summary Three transitive packages in `uv.lock` sat inside vulnerable ranges flagged by Dependabot. This bumps them past the advisories - lockfile-only, nothing changes in `pyproject.toml`. ## The alerts - `idna` 3.11 -> 3.18: CVE-2026-45409 (medium) - crafted input to `idna.encode()` bypassing an older fix; reachable through `yarl`/`aiohttp` host parsing - `python-dotenv` 1.2.1 -> 1.2.2: CVE-2026-28684 (medium) - symlink following in `set_key`; we never write .env files, near-zero exposure, fixed anyway - `Pygments` 2.19.2 -> 2.20.0: CVE-2026-4539 (low) - ReDoS in a highlighting regex; we highlight nothing user-supplied Two more open alerts point at `poetry.lock`, a file removed by the uv migration - they will be dismissed by hand after this merges. ## Verification - Full `task ci` green on the updated environment: checks, 129 unit tests, 6 live integration tests, build - Renovate stays silent on these because its vulnerability alerts cover direct dependencies only - transitive bumps go by hand --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-13 19:48:05 +00:00