Conversation
Updates 10 packages to patched versions across pyproject.toml, extras, and uv.lock: cryptography 46.0.7 → 49.0.0 (GHSA-537c-gmf6-5ccf) pillow 12.2.0 → 12.3.0 (16 GHSA findings) mcp 1.26.0 → 1.28.1 (GHSA-hvrp-rf83-w775 et al.) httplib2 0.31.2 → 0.32.0 (GHSA-j5g9-f88f-gfj3) pyasn1 0.6.3 → 0.6.4 (GHSA-8ppf-4f7h-5ppj et al.) Pygments 2.19.2 → 2.20.0 (GHSA-5239-wwwm-4pmq) PyNaCl 1.5.0 → 1.6.2 (GHSA-mrfv-m5wm-5w6w) starlette 1.0.1 → 1.3.1 (GHSA-82w8-qh3p-5jfq et al.) python-multipart 0.0.27 → 0.0.32 (GHSA-5rvq-cxj2-64vf et al.) pydantic-settings 2.13.1 → 2.14.2 (GHSA-4xgf-cpjx-pc3j) Also pins python-multipart to ==0.0.32 (was >=0.0.9,<1) and adds pydantic-settings==2.14.2 to the [mcp] extra.
Hansua155
force-pushed
the
security-upgrades-20260726
branch
from
July 26, 2026 05:22
e1394a2 to
46923c9
Compare
alt-glitch
added
type/security
Collaborator
|
Partial overlap with #72362 (merged): starlette/python-multipart current on main; cryptography landed at 48.0.1 — note 49.0.0 as proposed here cannot resolve (msal and alibabacloud-tea-openapi cap <49). Still unique: mcp 1.28.1, Pillow 12.3.0, pydantic-settings 2.14.2 bumps. Worth rebasing down to the residue. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Updates 10 PyPI packages to versions without known vulnerabilities (verified against OSV.dev):
cryptographypillowmcphttplib2pyasn1PygmentsPyNaClstarlettepython-multipartpydantic-settingsChanges
pyproject.toml
cryptography==46.0.7→cryptography==49.0.0Pillow==12.2.0→Pillow==12.3.0python-multipart>=0.0.9,<1→python-multipart==0.0.32(exact pin)starlette==1.0.1→starlette==1.3.1in [dev], [mcp], [computer-use], [web] extrasmcp==1.26.0→mcp==1.28.1in [dev], [mcp], [computer-use] extraspydantic-settings==2.14.2to [mcp] extra for GHSA-4xgf-cpjx-pc3juv.lock
uv lockafter pin updatesVerification: 137 components scanned against OSV.dev — 0 remaining vulnerabilities across all upgraded packages.