From ea905f89da73b5141160d1539e81fe13e0929b8d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 30 Mar 2026 12:05:04 +0000 Subject: [PATCH 1/4] Bump astral-sh/setup-uv from 7.6.0 to 8.0.0 Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 7.6.0 to 8.0.0. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](https://github.com/astral-sh/setup-uv/compare/v7.6...v8.0.0) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 8.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/code_checks.yml | 2 +- .github/workflows/docs.yml | 2 +- .github/workflows/integration_tests.yml | 2 +- .github/workflows/publish.yml | 2 +- .github/workflows/unit_tests.yml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/code_checks.yml b/.github/workflows/code_checks.yml index 0a27eca0..c07ed9d3 100644 --- a/.github/workflows/code_checks.yml +++ b/.github/workflows/code_checks.yml @@ -32,7 +32,7 @@ jobs: - uses: actions/checkout@v6.0.2 - name: Install uv - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 + uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 with: # Install a specific version of uv. version: "0.5.21" diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 1b8b321d..98dc6c2a 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -45,7 +45,7 @@ jobs: uses: actions/checkout@v6.0.2 - name: Install uv - uses: astral-sh/setup-uv@v7.6.0 + uses: astral-sh/setup-uv@v8.0.0 with: version: "0.5.21" enable-cache: true diff --git a/.github/workflows/integration_tests.yml b/.github/workflows/integration_tests.yml index 6385f8b5..b1a0a97a 100644 --- a/.github/workflows/integration_tests.yml +++ b/.github/workflows/integration_tests.yml @@ -44,7 +44,7 @@ jobs: - uses: actions/checkout@v6.0.2 - name: Install uv - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 + uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 with: # Install a specific version of uv. version: "0.5.21" diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index ed4d2cf6..08f89fb2 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -19,7 +19,7 @@ jobs: - uses: actions/checkout@v6.0.2 - name: Install uv - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 + uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 with: # Install a specific version of uv. version: "0.5.21" diff --git a/.github/workflows/unit_tests.yml b/.github/workflows/unit_tests.yml index 8dd163ce..520420f2 100644 --- a/.github/workflows/unit_tests.yml +++ b/.github/workflows/unit_tests.yml @@ -44,7 +44,7 @@ jobs: - uses: actions/checkout@v6.0.2 - name: Install uv - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 + uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 with: # Install a specific version of uv. version: "0.5.21" From 84ef8dc2b8b1e7b3a1eca0d8f73a7d2362202edd Mon Sep 17 00:00:00 2001 From: Marcelo Lotif Date: Mon, 30 Mar 2026 13:25:28 -0400 Subject: [PATCH 2/4] Update ignored vulnerabilities in code_checks.yml Add CVE-2026-4539 to the list of ignored vulnerabilities. --- .github/workflows/code_checks.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/code_checks.yml b/.github/workflows/code_checks.yml index c07ed9d3..6abb3792 100644 --- a/.github/workflows/code_checks.yml +++ b/.github/workflows/code_checks.yml @@ -56,5 +56,7 @@ jobs: with: virtual-environment: .venv/ # GHSA-4xh5-x5gv-qwph: This is a vulnerability in pip 25.2 that has no fix version yet + # CVE-2026-4539: This is a vulnerability in pygments that has no fix version yet ignore-vulns: | GHSA-4xh5-x5gv-qwph + CVE-2026-4539 From 7cc8a012a8aec917865ffd516f9952ead9533a11 Mon Sep 17 00:00:00 2001 From: Marcelo Lotif Date: Mon, 30 Mar 2026 13:32:44 -0400 Subject: [PATCH 3/4] pip-audit: upgrading packages and removing ignores --- .github/workflows/code_checks.yml | 5 ----- uv.lock | 18 +++++++++--------- 2 files changed, 9 insertions(+), 14 deletions(-) diff --git a/.github/workflows/code_checks.yml b/.github/workflows/code_checks.yml index 6abb3792..b3fcfb73 100644 --- a/.github/workflows/code_checks.yml +++ b/.github/workflows/code_checks.yml @@ -55,8 +55,3 @@ jobs: uses: pypa/gh-action-pip-audit@1220774d901786e6f652ae159f7b6bc8fea6d266 with: virtual-environment: .venv/ - # GHSA-4xh5-x5gv-qwph: This is a vulnerability in pip 25.2 that has no fix version yet - # CVE-2026-4539: This is a vulnerability in pygments that has no fix version yet - ignore-vulns: | - GHSA-4xh5-x5gv-qwph - CVE-2026-4539 diff --git a/uv.lock b/uv.lock index f4846d43..8517cc8e 100644 --- a/uv.lock +++ b/uv.lock @@ -2089,11 +2089,11 @@ wheels = [ [[package]] name = "pip" -version = "26.0" +version = "26.0.1" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/44/c2/65686a7783a7c27a329706207147e82f23c41221ee9ae33128fc331670a0/pip-26.0.tar.gz", hash = "sha256:3ce220a0a17915972fbf1ab451baae1521c4539e778b28127efa79b974aff0fa", size = 1812654, upload-time = "2026-01-31T01:40:54.361Z" } +sdist = { url = "https://files.pythonhosted.org/packages/48/83/0d7d4e9efe3344b8e2fe25d93be44f64b65364d3c8d7bc6dc90198d5422e/pip-26.0.1.tar.gz", hash = "sha256:c4037d8a277c89b320abe636d59f91e6d0922d08a05b60e85e53b296613346d8", size = 1812747, upload-time = "2026-02-05T02:20:18.702Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/69/00/5ac7aa77688ec4d34148b423d34dc0c9bc4febe0d872a9a1ad9860b2f6f1/pip-26.0-py3-none-any.whl", hash = "sha256:98436feffb9e31bc9339cf369fd55d3331b1580b6a6f1173bacacddcf9c34754", size = 1787564, upload-time = "2026-01-31T01:40:52.252Z" }, + { url = "https://files.pythonhosted.org/packages/de/f0/c81e05b613866b76d2d1066490adf1a3dbc4ee9d9c839961c3fc8a6997af/pip-26.0.1-py3-none-any.whl", hash = "sha256:bdb1b08f4274833d62c1aa29e20907365a2ceb950410df15fc9521bad440122b", size = 1787723, upload-time = "2026-02-05T02:20:16.416Z" }, ] [[package]] @@ -2365,11 +2365,11 @@ wheels = [ [[package]] name = "pygments" -version = "2.19.2" +version = "2.20.0" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/b0/77/a5b8c569bf593b0140bde72ea885a803b82086995367bf2037de0159d924/pygments-2.19.2.tar.gz", hash = "sha256:636cb2477cec7f8952536970bc533bc43743542f70392ae026374600add5b887", size = 4968631, upload-time = "2025-06-21T13:39:12.283Z" } +sdist = { url = "https://files.pythonhosted.org/packages/c3/b2/bc9c9196916376152d655522fdcebac55e66de6603a76a02bca1b6414f6c/pygments-2.20.0.tar.gz", hash = "sha256:6757cd03768053ff99f3039c1a36d6c0aa0b263438fcab17520b30a303a82b5f", size = 4955991, upload-time = "2026-03-29T13:29:33.898Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/c7/21/705964c7812476f378728bdf590ca4b771ec72385c533964653c68e86bdc/pygments-2.19.2-py3-none-any.whl", hash = "sha256:86540386c03d588bb81d44bc3928634ff26449851e99741617ecb9037ee5ec0b", size = 1225217, upload-time = "2025-06-21T13:39:07.939Z" }, + { url = "https://files.pythonhosted.org/packages/f4/7e/a72dd26f3b0f4f2bf1dd8923c85f7ceb43172af56d63c7383eb62b332364/pygments-2.20.0-py3-none-any.whl", hash = "sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176", size = 1231151, upload-time = "2026-03-29T13:29:30.038Z" }, ] [[package]] @@ -2589,7 +2589,7 @@ wheels = [ [[package]] name = "requests" -version = "2.32.5" +version = "2.33.1" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "certifi" }, @@ -2597,9 +2597,9 @@ dependencies = [ { name = "idna" }, { name = "urllib3" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/c9/74/b3ff8e6c8446842c3f5c837e9c3dfcfe2018ea6ecef224c710c85ef728f4/requests-2.32.5.tar.gz", hash = "sha256:dbba0bac56e100853db0ea71b82b4dfd5fe2bf6d3754a8893c3af500cec7d7cf", size = 134517, upload-time = "2025-08-18T20:46:02.573Z" } +sdist = { url = "https://files.pythonhosted.org/packages/5f/a4/98b9c7c6428a668bf7e42ebb7c79d576a1c3c1e3ae2d47e674b468388871/requests-2.33.1.tar.gz", hash = "sha256:18817f8c57c6263968bc123d237e3b8b08ac046f5456bd1e307ee8f4250d3517", size = 134120, upload-time = "2026-03-30T16:09:15.531Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/1e/db/4254e3eabe8020b458f1a747140d32277ec7a271daf1d235b70dc0b4e6e3/requests-2.32.5-py3-none-any.whl", hash = "sha256:2462f94637a34fd532264295e186976db0f5d453d1cdd31473c85a6a161affb6", size = 64738, upload-time = "2025-08-18T20:46:00.542Z" }, + { url = "https://files.pythonhosted.org/packages/d7/8e/7540e8a2036f79a125c1d2ebadf69ed7901608859186c856fa0388ef4197/requests-2.33.1-py3-none-any.whl", hash = "sha256:4e6d1ef462f3626a1f0a0a9c42dd93c63bad33f9f1c1937509b8c5c8718ab56a", size = 64947, upload-time = "2026-03-30T16:09:13.83Z" }, ] [[package]] From f02265714780a850b5ff1efef43f35321b5fed98 Mon Sep 17 00:00:00 2001 From: Marcelo Lotif Date: Mon, 30 Mar 2026 13:50:17 -0400 Subject: [PATCH 4/4] Downgrading pygments back and adding a ignore instead --- .github/workflows/code_checks.yml | 3 +++ uv.lock | 6 +++--- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/workflows/code_checks.yml b/.github/workflows/code_checks.yml index b3fcfb73..191ee594 100644 --- a/.github/workflows/code_checks.yml +++ b/.github/workflows/code_checks.yml @@ -55,3 +55,6 @@ jobs: uses: pypa/gh-action-pip-audit@1220774d901786e6f652ae159f7b6bc8fea6d266 with: virtual-environment: .venv/ + # CVE-2026-4539: This is a vulnerability in pygments that can't be upgraded + ignore-vulns: | + CVE-2026-4539 diff --git a/uv.lock b/uv.lock index 8517cc8e..a2a6861c 100644 --- a/uv.lock +++ b/uv.lock @@ -2365,11 +2365,11 @@ wheels = [ [[package]] name = "pygments" -version = "2.20.0" +version = "2.19.2" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/c3/b2/bc9c9196916376152d655522fdcebac55e66de6603a76a02bca1b6414f6c/pygments-2.20.0.tar.gz", hash = "sha256:6757cd03768053ff99f3039c1a36d6c0aa0b263438fcab17520b30a303a82b5f", size = 4955991, upload-time = "2026-03-29T13:29:33.898Z" } +sdist = { url = "https://files.pythonhosted.org/packages/b0/77/a5b8c569bf593b0140bde72ea885a803b82086995367bf2037de0159d924/pygments-2.19.2.tar.gz", hash = "sha256:636cb2477cec7f8952536970bc533bc43743542f70392ae026374600add5b887", size = 4968631, upload-time = "2025-06-21T13:39:12.283Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/f4/7e/a72dd26f3b0f4f2bf1dd8923c85f7ceb43172af56d63c7383eb62b332364/pygments-2.20.0-py3-none-any.whl", hash = "sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176", size = 1231151, upload-time = "2026-03-29T13:29:30.038Z" }, + { url = "https://files.pythonhosted.org/packages/c7/21/705964c7812476f378728bdf590ca4b771ec72385c533964653c68e86bdc/pygments-2.19.2-py3-none-any.whl", hash = "sha256:86540386c03d588bb81d44bc3928634ff26449851e99741617ecb9037ee5ec0b", size = 1225217, upload-time = "2025-06-21T13:39:07.939Z" }, ] [[package]]