Repository navigation
Bump authlib from 1.6.9 to 1.6.11 in /envs/git_env - #554
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
Dependencies
python:uv
|
No reviewable files after applying ignore patterns. |
meta-cla
Bot
added
the
CLA Signed
Darktex
left a comment
Darktex
left a comment
There was a problem hiding this comment.
Note: This is an automated review by Claude Code, not a human review.
Pure lockfile bump in envs/git_env/uv.lock. The two intermediate authlib releases fix real security issues worth noting:
- 1.6.10: open-redirect — server would redirect to an unvalidated
redirect_urionUnsupportedResponseTypeError. Relevant ifgit_envuses an OAuth server flow. - 1.6.11: CSRF in the Starlette OAuth client when a
cacheis configured. OpenEnv's core uses FastAPI/Starlette, so this is directly applicable.
Both are security fixes with no public API changes. No OpenEnv invariants are at stake (no Python source modified, no client-server boundary touched). Lockfile hashes are pinned and verifiable against PyPI. Safe to merge.
Automated review by Claude Code | Learn more
Darktex
left a comment
Darktex
left a comment
There was a problem hiding this comment.
Note: This is an automated review by Claude Code, not a human review.
Clean security patch bump: authlib 1.6.9 → 1.6.11 in envs/git_env/uv.lock.
Tier 1: authlib sdist/wheel hashes update consistently; only envs/git_env/uv.lock changes. The lock revision bumps 2 → 3 and resolution-markers grow — standard uv lock-format evolution, not new direct deps. Transitive additions (e.g., audioop-lts as a Python 3.13+ audioop shim, and the openenv-core graph materializing transitively, incl. gradio) come from uv re-resolving against the expanded platform matrix, not from a concealed pyproject.toml change.
Tier 2: No alignment concerns — authlib is env-server-side auth; doesn't cross the agent/environment boundary.
Security content worth taking:
- 1.6.11: CSRF fix in Starlette OAuth client (with cache)
- 1.6.10: unvalidated
redirect_urionUnsupportedResponseTypeError
Automated review by Claude Code | Learn more
Darktex
left a comment
Darktex
left a comment
There was a problem hiding this comment.
Note: This is an automated review by Claude Code, not a human review.
Only envs/git_env/uv.lock is touched. The authlib bump is from 1.6.9 to 1.6.11; hashes match the canonical PyPI release. Lock churn (revision bump, new resolution markers, audioop-lts additions) is standard uv re-resolution and carries no new direct dependencies.
Automated review by Claude Code | Learn more
72e2763 to
78ce2e9
Compare
Bumps [authlib](https://github.com/authlib/authlib) from 1.6.9 to 1.6.11. - [Release notes](https://github.com/authlib/authlib/releases) - [Changelog](https://github.com/authlib/authlib/blob/v1.6.11/docs/changelog.rst) - [Commits](authlib/authlib@v1.6.9...v1.6.11) --- updated-dependencies: - dependency-name: authlib dependency-version: 1.6.11 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
78ce2e9 to
3d3014e
Compare
Darktex
left a comment
Darktex
left a comment
There was a problem hiding this comment.
Automated dependency bump review: patch-level version bump of authlib (1.6.9 -> 1.6.11) in /envs/git_env. Diff is confined to envs/git_env/uv.lock only — no source, config, or Dockerfile changes. The additional lock-file churn is normal output of uv lock regeneration. Approving.
Darktex
left a comment
Darktex
left a comment
There was a problem hiding this comment.
Patch/minor bump of authlib (1.6.9 → 1.6.11) — includes CSRF fix in Starlette OAuth client. Diff scope limited to uv.lock for the env. LGTM.
Darktex
left a comment
Darktex
left a comment
There was a problem hiding this comment.
Note: This is an automated review by Claude Code, not a human review.
Bumps authlib from 1.6.9 to 1.6.11 in envs/git_env/uv.lock.
- Only
envs/git_env/uv.lockis modified — no source code touched. - 1.6.11 is a patch release containing bugfixes and minor security hardening; no breaking API changes in the 1.6.x line.
- All 6 CI checks (build, tests, lint) are green.
- authlib is a transitive/test-time dep in this env; no direct usage in
git_envsource.
Automated review by Claude Code | Learn more
|
Superseded by merged rollup PR #562, which includes this dependency update along with the rest of the current Dependabot environment queue. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
Bumps authlib from 1.6.9 to 1.6.11.
Release notes
Sourced from authlib's releases.
Changelog
Sourced from authlib's changelog.
Commits
0dc0e5bchore: bump to 1.6.11aa7b8e4Merge commit from fork401a770fix: CSRF issue with starlette clientef09aebchore: release 1.6.103be0846fix: redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError