Skip to content

fix(deps): vuln uv (unstable → 0.11.10) #273

Open
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
mainfrom
engraver-auto-version-upgrade/unstable/uv/0-1778210260
Open

fix(deps): vuln uv (unstable → 0.11.10) #273
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
mainfrom
engraver-auto-version-upgrade/unstable/uv/0-1778210260

Conversation

@gh-worker-campaigns-3e9aa4
Copy link
Copy Markdown

Summary: Security update — 1 package upgraded (UNSTABLE changes included)

Manifests changed:

  • . (uv)

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.


Updates

Package From To Type Dep Type Vulnerabilities Fixed
uv 0.8.11 0.11.10 unstable Direct 3 MODERATE, 2 LOW

Security Details

ℹ️ Other Vulnerabilities (5)
Package CVE Severity Summary Unsafe Version Fixed In
uv GHSA-pqhf-p39g-3x64 MODERATE uv allows ZIP payload obfuscation through parsing differentials 0.8.11 0.9.6
uv CVE-2025-13327 MODERATE - 0.8.11 -
uv GHSA-v653-r55g-hcmg MODERATE uv has ZIP payload obfuscation through parsing differentials 0.8.11 0.9.6
uv GHSA-w476-p2h3-79g9 LOW uv has differential in tar extraction with PAX headers 0.8.11 0.9.5
uv GHSA-pjjw-68hj-v9mw LOW uv vulnerable to arbitrary file deletion through RECORD entries 0.8.11 0.11.6

Review Checklist

Standard review:

  • Review changes for compatibility with your code
  • Check for breaking changes in release notes
  • Run tests locally or wait for CI
  • Approve and merge this PR

Update Mode: Vulnerability Remediation

🤖 Generated by DataDog Automated Dependency Management System

@datadog-datadog-prod-us1-2
Copy link
Copy Markdown

🎯 Code Coverage (details)
Patch Coverage: 100.00%
Overall Coverage: 71.07% (-0.07%)

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: cbb0e0e | Docs | Datadog PR Page | Give us feedback!

@campaigner-prod campaigner-prod Bot marked this pull request as ready for review May 8, 2026 12:02
@campaigner-prod campaigner-prod Bot requested a review from a team as a code owner May 8, 2026 12:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants