chore: fold strict dependency-floor lock metadata into security baseline - #520
Conversation
…1, setuptools 83.0.0 Clears all 19 trivy-fs findings in uv.lock: - pillow 12.2.0 -> 12.3.0 (13 CVEs incl. CVE-2026-54058, CVE-2026-59197) - pypdf 6.13.3 -> 6.14.2 (CVE-2026-59935..59938) - pymdown-extensions 10.21.3 -> 11.0.1 (CVE-2026-61632) - setuptools 81.0.0 -> 83.0.0 (CVE-2026-59890) - mkdocs-material 9.6.23 -> 9.7.7 (drops the pymdown-extensions~=10.2 cap) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The <9.7 hold blocked pymdown-extensions 11 (needed for CVE-2026-61632). Validated per the CONTRIBUTING exit clause: 'uv run mkdocs build --strict' passes on material 9.7.7 with mkdocs still 1.6.1. Guard tests and CONTRIBUTING now document the validated >=9.7,<9.8 line; the mkdocs<2.0 hold stays. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
|
Closing this temporary integration PR because GitHub cannot produce a merge preview for the diverged lock histories. The canonical #467 branch already contains the reviewed strict |
1 participant
Temporary integration PR into #467's feature branch. It imports only the stricter Pillow/pypdf project-floor metadata already reviewed in closed #517. The merge preview must retain Click 8.4.2 and the httpx2/httpcore2/truststore removals before this is merged.