fix(deps): upgrade vulnerable transitive dependencies [security]#74
fix(deps): upgrade vulnerable transitive dependencies [security]#74lawrence-u10d wants to merge 1 commit intomainfrom
Conversation
Packages upgraded: aiohttp filelock jupyterlab nbconvert pip pygments pypdf python-multipart requests starlette tornado urllib3 virtualenv Automated by lockfile-security-scan workflow.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Closing: still investigating Azure URL issue. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
| [project] | ||
| name = "uns_mcp" | ||
| version = "0.1.6" # Set only non-dev versions to release | ||
| version = "0.1.7" # Set only non-dev versions to release |
There was a problem hiding this comment.
Version bump triggers unintended PyPI release of dev code
High Severity
Bumping version from 0.1.6 to 0.1.7 in pyproject.toml will trigger the release.yml workflow on merge, which automatically publishes to PyPI whenever it detects a version change on main. The 0.1.7-dev0 CHANGELOG entry indicates development work is still in progress and hasn't been formally released. This automated security-fix PR would inadvertently publish a new release containing unreleased dev changes.
Additional Locations (1)
utic-github-cicd-token-generator
Bot
deleted the
security/lockfile-transitive-deps
branch
1 participant
Summary
Automated scan found CVEs in transitive dependencies locked in
uv.lockfiles.These packages were upgraded to patched versions.
Remediated vulnerabilities
Skipped (major version bump required)
What this PR does
uv.lockfiles with grype for known CVEsuv lock --upgrade-package <pkg>for each fixable vulnerability (skips major bumps)version-bumpNote
Low Risk
Low risk release metadata update: only
pyproject.tomlversion andCHANGELOG.mdentries change, with no runtime code modifications shown in this diff.Overview
Prepares the
0.1.7release by updatingpyproject.tomlfrom0.1.6to0.1.7.Adds a
0.1.7Security entry toCHANGELOG.mdnoting upgraded vulnerable transitive dependencies.Written by Cursor Bugbot for commit 27cb64d. This will update automatically on new commits. Configure here.