Skip to content

fix: fix uv audit warnings - #95

Merged
ninoseki merged 2 commits into
mainfrom
2026-10-06-uv-audit
Oct 6, 2026
Merged

ninoseki merged 2 commits into
mainfrom
2026-10-06-uv-audit

Conversation

@ninoseki

@ninoseki ninoseki commented Oct 6, 2026

Copy link
Copy Markdown
Contributor

Fix the following warnings by uv sync --upgrade:

$ uv audit                                
warning: `uv audit` is experimental and may change without warning. Pass `--preview-features audit-command` to disable this warning.
Resolved 85 packages in 4ms
Found 8 known vulnerabilities and no adverse project statuses in 84 packages

Vulnerabilities:

click 8.3.1 has 1 known vulnerability:

- PYSEC-2026-2132: No summary provided

  Fixed in: 8.3.3

  Advisory information: https://access.redhat.com/errata/RHSA-2026:24761

urllib3 2.7.0 has 6 known vulnerabilities:

- GHSA-8988-9cw3-xx77: urllib3: HTTPS proxy TLS configuration may be ignored or overridden

  Fixed in: 2.8.0

  Advisory information: https://nvd.nist.gov/vuln/detail/CVE-2026-97687

- GHSA-gh4c-6fx4-qh6g: urllib3: Chunked Deflate streaming can enter an infinite loop

  Fixed in: 2.8.0

  Advisory information: https://nvd.nist.gov/vuln/detail/CVE-2026-97688

- GHSA-vxq7-64xx-v4gw: urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory

  Fixed in: 2.8.0

  Advisory information: https://nvd.nist.gov/vuln/detail/CVE-2026-97689

- PYSEC-2026-4175: urllib3: HTTPS proxy TLS configuration may be ignored or overridden

  Fixed in: 2.8.0

  Advisory information: https://nvd.nist.gov/vuln/detail/CVE-2026-97687

- PYSEC-2026-4176: urllib3: Chunked Deflate streaming can enter an infinite loop

  Fixed in: 2.8.0

  Advisory information: https://nvd.nist.gov/vuln/detail/CVE-2026-97688

- PYSEC-2026-4177: urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory

  Fixed in: 2.8.0

  Advisory information: https://nvd.nist.gov/vuln/detail/CVE-2026-97689

werkzeug 3.1.8 has 1 known vulnerability:

- GHSA-g6x2-hccm-hh4m: Werkzeug safe_join() allows Windows special device names

  Fixed in: 3.1.9

  Advisory information: https://nvd.nist.gov/vuln/detail/CVE-2026-102598

@ninoseki
ninoseki requested review from cdnsyseng and fw42 October 6, 2026 08:45
@ninoseki
ninoseki merged commit ef2d7de into main Oct 6, 2026
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants