Skip to content

chore: Update lxml and other vulnerabilities (M2-10532) - #2043

Merged
divbzero merged 5 commits into
developfrom
M2-10532-update-lxml-vulnerability
May 1, 2026
Merged

chore: Update lxml and other vulnerabilities (M2-10532)#2043
divbzero merged 5 commits into
developfrom
M2-10532-update-lxml-vulnerability

Conversation

@divbzero

Copy link
Copy Markdown
Contributor

📝 Description

🔗 Jira Ticket M2-10532

Audit dependencies:

make audit

Update direct dependencies:

uv add "cryptography>=46.0.7"
uv add "python-multipart>=0.0.26"
uv add --dev "pytest>=9.0.3" "pytest-asyncio>=1.3.0"

Update indirect dependencies:

uv sync --upgrade-package lxml
uv sync --upgrade-package python-dotenv

🪤 Peer Testing

Sync dependencies:

uv sync

Lint and type check:

make cq

Build and start dependencies:

make build
make start-deps

Test:

make test

✏️ Notes

Before:

Vulnerabilities detected!
Checked: 184 dependencies
Vulnerable: 5 vulnerabilities (4 medium, 1 high)

┏━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ Package                 ┃ Version         ┃ Vulnerability ID             ┃ Severity     ┃ Fix Versions      ┃ Aliases                    ┃
┡━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━┩
│ cryptography            │ 46.0.6          │ GHSA-p423-j2cm-9vmq          │ MEDIUM       │ 46.0.7            │ CVE-2026-39892             │
│ lxml                    │ 6.0.0           │ GHSA-vfmq-68hx-4jfw          │ HIGH         │ 6.1.0             │ CVE-2026-41066             │
│ pytest                  │ 8.4.0           │ GHSA-6w46-j5rx-g56g          │ MEDIUM       │ 9.0.3             │ CVE-2025-71176             │
│ python-dotenv           │ 1.1.1           │ GHSA-mf9w-mj56-hr94          │ MEDIUM       │ 1.2.2             │ CVE-2026-28684             │
│ python-multipart        │ 0.0.22          │ GHSA-mj87-hwqh-73pj          │ MEDIUM       │ 0.0.26            │ CVE-2026-40347             │
└─────────────────────────┴─────────────────┴──────────────────────────────┴──────────────┴───────────────────┴────────────────────────────┘

After:

No vulnerabilities or maintenance issues detected!
Checked: 184 dependencies
All dependencies appear safe!

@divbzero
divbzero requested a review from adeiji April 27, 2026 21:36

@adeiji adeiji left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good!

@divbzero
divbzero merged commit f167b04 into develop May 1, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants