chore(deps): bump pygments 2.19.2 → 2.20.0 (GHSA-5239-wwwm-4pmq, ReDoS) by cmeans-claude-dev[bot] · Pull Request #82 · cmeans/mcp-synology

cmeans-claude-dev · 2026-05-01T16:33:41Z

Summary

Closes Dependabot alert #3. Pygments < 2.20.0 has an inefficient regex for GUID matching that can be triggered into ReDoS by crafted input — GHSA-5239-wwwm-4pmq (severity Low, patched in 2.20.0).

Scope

Transitive dev-dep via pytest 9.0.3 (the test suite uses Pygments for syntax-highlighting traceback output). Runtime is unaffected — production never imports Pygments.
Bumped via uv lock --upgrade-package pygments. Only uv.lock changed; pyproject.toml did not need an adjustment because pytest doesn't pin Pygments to an upper bound.

Diff at a glance

```diff
[[package]]
name = "pygments"
-version = "2.19.2"
+version = "2.20.0"
```

Plus the corresponding sdist + wheel hash updates in uv.lock and a one-line CHANGELOG entry.

QA

Manual tests

- Run uv run pytest — 554 passed at 96.13% coverage.
- Run uv run ruff check src/ tests/ scripts/ — clean.
- Run uv run ruff format --check src/ tests/ scripts/ — clean.
- Run uv run mypy src/ scripts/ — clean (30 files, strict-mode).
- Spot-check grep -A 2 "name = \"pygments\"" uv.lock — version is now 2.20.0.
- After merge: confirm Dependabot auto-closes alert Move better favicon into icons/ directory #3 (it monitors uv.lock per the repo's Dependabot config and matches the patched range).

Verification I already ran

Check	Result
`uv run pytest`	554 passed, 100 deselected, 96.13% coverage on bumped lockfile
`uv run ruff check src/ tests/ scripts/`	clean
`uv run mypy src/ scripts/`	clean
Advisory lookup	GHSA-5239-wwwm-4pmq vulnerable_version_range = `< 2.20.0`, first_patched_version = `2.20.0` (matches the bump)

🤖 Generated with Claude Code

Closes Dependabot alert #3 on cmeans/mcp-synology. Pygments < 2.20.0 has an inefficient regex for GUID matching that can be triggered into ReDoS by crafted input; severity Low. Pygments is a transitive dev-dep via pytest 9.0.3 (test suite uses it for syntax-highlighting traceback output). Runtime is unaffected. Bumped via `uv lock --upgrade-package pygments`. Only uv.lock changed; no pyproject.toml constraint adjustment needed because pytest doesn't pin Pygments to an upper bound. Verification on the bumped lockfile: - uv run pytest: 554 passed, 100 deselected, 96.13% coverage - uv run ruff check src/ tests/ scripts/: clean - uv run mypy src/ scripts/: clean Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cmeans

LGTM

codecov-commenter · 2026-05-01T16:34:43Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

cmeans

QA Round 1 — PASS

Tight, well-scoped Pygments security bump. Closes Dependabot alert #3 / GHSA-5239-wwwm-4pmq.

Independent advisory verification

Field	Claim	Verified via `gh api /advisories/GHSA-5239-wwwm-4pmq`
Summary	"Inefficient regex for GUID matching → ReDoS"	`Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching` ✓
Severity	Low	`low` ✓
Vulnerable range	`< 2.20.0`	`< 2.20.0` ✓
First patched	`2.20.0`	`2.20.0` ✓
Ecosystem	pip / Python	`pip` ✓

Scope check

grep -rn pygments src/ scripts/ pyproject.toml returned zero hits — confirms Pygments is NOT used by any production or release-tooling code. The PR's "runtime is unaffected — production never imports Pygments" claim is accurate.
uv.lock shows the package landing as a transitive dep under pytest (the { name = "pygments" } line appears in pytest's dependency block). PR's "transitive dev-dep via pytest 9.0.3" claim verified.
pyproject.toml doesn't reference Pygments — no constraint adjustment needed, matching the PR's claim.

Diff sanity

File	Change
`uv.lock`	Pygments 2.19.2 → 2.20.0; sdist + wheel hashes updated; upload-time on new wheel `2026-03-29T13:29:30Z` (published before this scan window). No collateral entries touched.
`CHANGELOG.md`	One new line under `## Unreleased` → `### Fixed`. References the advisory, the dependabot alert, the dev-only scope.

Verification

Check	Result
`uv run pytest`	554 passed, 100 deselected, 96.13% coverage on the bumped lockfile
`uv run ruff check src/ tests/ scripts/`	clean
`uv run ruff format --check src/ tests/ scripts/`	72 files already formatted
`uv run mypy src/ scripts/`	clean (30 files, strict-mode)
Required CI on `84402b59`	13/13 green (vdsm completed `SUCCESS`)

PR-body manual tests 1–6 all checked. (#6 is post-merge — Dependabot alert auto-close monitors uv.lock and matches < 2.20.0, so it should close on merge.)

Verdict

Ready for QA Signoff. Final maintainer call.

cmeans · 2026-05-01T16:38:32Z

Applying Ready for QA Signoff as the final act of round 1. Pygments 2.19.2 → 2.20.0 to clear GHSA-5239-wwwm-4pmq (Low-severity ReDoS); advisory verified via gh api (vulnerable_version_range < 2.20.0, first_patched_version 2.20.0 — both match). Confirmed pygments is not imported anywhere in src/ or scripts/, and pyproject.toml has no upper bound that needed adjustment. 554/554 pass on bumped lockfile, 96.13% coverage, ruff/mypy clean, 13/13 required CI green. Final maintainer call.

## Summary Cuts v0.5.2, shipping six PRs that landed since v0.5.1 (2026-05-01): - **#79** mcp-publisher v1.5.0 → v1.7.6 (registry OIDC audience fix) - **#80** keyring exception handler narrowing (closes #38) - **#81** bg update-check executor timeout + log (closes #39) - **#82** pygments 2.19.2 → 2.20.0 (GHSA-5239-wwwm-4pmq, ReDoS) - **#83** `--revert` version-string validation (closes #40) - **#85** per-path serial for `move_files` + `copy_files` (closes #84) ## Why now Two recent bug fixes (#83, #85) are user-visible enough to warrant shipping, and #84 in particular is a confusing silent-no-op regression on multi-file moves — getting that to PyPI promptly matters. The four post-0.5.1 quality fixes (#79–#82) are stacked behind it. This release also exercises **#79's mcp-publisher v1.7.6 pin end-to-end** so the registry can catch up to current. v0.5.1's registry entry is missing because #79 landed AFTER the v0.5.1 tag-push, and `actions/checkout@v6` resolved to the tag's commit on re-runs of the failed `publish-registry` job — the fix wasn't picked up. The v0.5.2 tag will pull the correct pin from main. ## State after merge Bug-labeled issue queue is empty. The structural multi-path-serial fix family (delete + getinfo + move + copy + restore) is now complete on real DSM 7.x — every File Station write tool that takes a `paths: list[str]` issues one DSM task per path, sidestepping the comma-joined-multipath quirk that #68 and #84 each surfaced. ## Files changed - `pyproject.toml` — version 0.5.1 → 0.5.2 - `server.json` — auto-synced via `python scripts/sync-server-json.py` - `uv.lock` — refreshed via `uv lock` - `CHANGELOG.md` — `## Unreleased` (with the six entries above) renamed to `## 0.5.2 (2026-05-01)`, fresh empty `## Unreleased` inserted above it for the next cycle ## Test plan - [x] CI green on this branch (lint, typecheck, test 3.11/3.12/3.13, vdsm integration tests, version-sync, validate-server-json) - [ ] After merge: tag `v0.5.2` push fires `publish.yml`; PyPI publish succeeds - [ ] After merge: `publish-registry` job succeeds end-to-end (this is the validation point for #79's fix — the failure mode in v0.5.1 was `invalid audience: expected https://registry.modelcontextprotocol.io, got [mcp-registry]`) - [ ] After tag: `mcp-synology --check-update` from a v0.5.1 install reports v0.5.2 available; `uv tool install mcp-synology@latest` upgrades cleanly - [ ] Smoke (post-install): two-file `move_files` actually moves both files (the #84 regression scenario) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: cmeans-claude-dev[bot] <272174644+cmeans-claude-dev[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

github-actions Bot added the Awaiting CI Dev complete, waiting for CI/Codecov to pass before QA label May 1, 2026

chore(changelog): pin pygments-bump entry to PR #82

84402b5

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

github-actions Bot added Ready for QA Dev work complete — QA can begin review and removed Awaiting CI Dev complete, waiting for CI/Codecov to pass before QA labels May 1, 2026

cmeans approved these changes May 1, 2026

View reviewed changes

cmeans added the QA Active QA is actively reviewing; Dev should not push changes label May 1, 2026

github-actions Bot removed the Ready for QA Dev work complete — QA can begin review label May 1, 2026

cmeans reviewed May 1, 2026

View reviewed changes

cmeans-claude-dev Bot merged commit fc0c3e9 into main May 1, 2026
34 checks passed

cmeans-claude-dev Bot deleted the fix/pygments-2.20.0-redos branch May 1, 2026 16:39

cmeans-claude-dev Bot mentioned this pull request May 1, 2026

Release v0.5.2 #86

Merged

5 tasks

cmeans mentioned this pull request May 2, 2026

Tracking: 2026-04-16 project-wide code review — findings and roadmap #51

Closed

18 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump pygments 2.19.2 → 2.20.0 (GHSA-5239-wwwm-4pmq, ReDoS)#82

chore(deps): bump pygments 2.19.2 → 2.20.0 (GHSA-5239-wwwm-4pmq, ReDoS)#82
cmeans-claude-dev[bot] merged 2 commits into
mainfrom
fix/pygments-2.20.0-redos

cmeans-claude-dev Bot commented May 1, 2026 •

edited by cmeans

Loading

Uh oh!

cmeans left a comment

Uh oh!

codecov-commenter commented May 1, 2026

Uh oh!

cmeans left a comment

Uh oh!

cmeans commented May 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

cmeans-claude-dev Bot commented May 1, 2026 • edited by cmeans Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Scope

Diff at a glance

QA

Manual tests

Verification I already ran

Uh oh!

cmeans left a comment

Choose a reason for hiding this comment

Uh oh!

codecov-commenter commented May 1, 2026

Codecov Report

Uh oh!

cmeans left a comment

Choose a reason for hiding this comment

QA Round 1 — PASS

Independent advisory verification

Scope check

Diff sanity

Verification

Verdict

Uh oh!

cmeans commented May 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

cmeans-claude-dev Bot commented May 1, 2026 •

edited by cmeans

Loading