security: remediate open Dependabot alerts - #346
Merged
Conversation
Bump vulnerable transitive and dev dependencies to their first patched versions via `poetry update` (regenerated poetry.lock). Only pyproject.toml (pytest constraint) and poetry.lock change. Alerts remediated: - pyasn1 -> 0.6.4 (high; GHSA, DoS) [5 alerts] - urllib3 -> 2.7.0 (high/med) [6 alerts] - protobuf -> 5.29.6 (high) [2 alerts] - msgpack -> 1.2.1 (high) - brotli -> 1.2.0 (high) - setuptools -> 84.0.0 (high/med) [2 alerts] - flask-cors -> 6.0.5 (medium) [3 alerts] - jinja2 -> 3.1.6 (medium) [3 alerts] - werkzeug -> 3.1.8 (medium) [2 alerts] - filelock -> 3.32.2 (medium) [2 alerts] - requests -> 2.34.2 (medium) [2 alerts] - idna -> 3.18 (medium) - virtualenv -> 21.7.4 (medium) - pytest -> 9.1.1 (medium) [dev; constraint ^8.3.3 -> ^9.0.3] - flask -> 3.1.3 (low) - pygments -> 2.20.0 (low) Deferred (breaking major bump, not verifiable locally): - pyarrow: needs 23.0.1 (current ^18.0.0); 5-major jump, existing Dependabot PR #340 already tracks pyarrow. - black: needs 26.3.1 (pinned =24.4.2, coupled to tool.black.required-version); black 26 reformats 3 files under vsb/, out of security scope. Verified locally (Python 3.11.15, poetry): poetry install; poetry check --lock; poetry run pytest tests/unit (33 passed); flake8 syntax/undefined-name check (0). Integration tests require Pinecone API key + Docker services and were not run.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Remediates the open Dependabot alerts on
VSBby bumping vulnerable transitive and dev dependencies to their first patched versions. Changes are confined topyproject.tomlandpoetry.lock(regenerated viapoetry update). CI already exists (python-package.yml,black.yml) — no CI changes.Packages fixed
poetry update^3.18.0already allowed)^8.3.3→^9.0.3Fixes 34 of 36 open alerts.
Deferred (2)
23.0.1, current constraint^18.0.0. A 5-major jump not verifiable locally (integration tests need external services). Existing Dependabot PR Bump pyarrow from 18.1.0 to 22.0.0 #340 already tracks pyarrow (18.1.0 → 22.0.0). Left for that PR / a dedicated major bump.26.3.1, currently pinned=24.4.2and coupled to[tool.black].required-version. Black 26 reformats 3 files undervsb/; reformatting application source is outside security scope and would need separate review. Dev/CI-only tool (ReDoS).Local verification (Python 3.11.15, Poetry)
poetry install— OKpoetry check --lock— consistent (only pre-existing poetry 1.x→2.x config deprecation warnings)poetry run pytest tests/unit --timeout=120— 33 passedpoetry run flake8 . --select=E9,F63,F7,F82— 0Note: the integration test suite (
tests/integration) requires a Pinecone API key + Docker (pgvector, opensearch) and was not run locally; it runs in CI on this PR.