Repository navigation
Land the pytest Dependabot bump and clear nltk/pygments advisories - #16
Merged
Merged
Conversation
Bumps the uv group with 1 update in the / directory: [pytest](https://github.com/pytest-dev/pytest). Updates `pytest` from 9.0.2 to 9.0.3 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@9.0.2...9.0.3) --- updated-dependencies: - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:production dependency-group: uv ... Signed-off-by: dependabot[bot] <support@github.com>
pip-audit over uv.lock flags two packages that Dependabot has not opened
PRs for:
- nltk 3.9.4: 50 advisories fixed in 3.10.0-3.10.3 (among them
GHSA-m42h-3232-vpv3, GHSA-qvv7-cg9c-w4x3, GHSA-fg7f-2386-8897)
- pygments 2.19.2: GHSA-5239-wwwm-4pmq, fixed in 2.20.0
nltk is a runtime dependency and CI installs from pyproject.toml rather
than the lock, so raise its floor to the first fixed release, as #13 did
for 3.9.4. pygments comes in only through pytest, so it is a lock-only
bump.
nltk 3.9.4 -> 3.10.4 (adds defusedxml)
pygments 2.19.2 -> 2.21.0
Four more nltk advisories list no fix version (PYSEC-2026-597,
PYSEC-2026-3740, PYSEC-2026-3955, PYSEC-2026-4318), but none of them
lists 3.10.4 as affected, and pip-audit over the new lock reports no
known vulnerabilities.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GmdbKVGsk81rJRHkUYAjNz
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Covers #15, plus two vulnerable packages Dependabot has not opened PRs for.
#15: pytest 9.0.2 -> 9.0.3
Merged as is. The branch was current with
main, so it fast-forwards and #15 closes as merged when this lands.nltk and pygments
Running
pip-auditover every package inuv.lockflags two more:nltk is a runtime dependency, and CI installs from
pyproject.tomlrather than the lock. So its floor goes up to the first fixed release, the same way #13 handled 3.9.4. pygments comes in only through pytest, so it is a lock-only bump.defusedxml)pip-auditover the new lock reports no known vulnerabilities.One nltk 3.10 behavior change
nltk.download()now refuses to fetch through an HTTP proxy, as SSRF protection. 3.9.4 downloads fine behind one. This does not affectgenerate.yml: it installs nltk unpinned throughg2p-enand does not readpyproject.toml, and GitHub-hosted runners do not go through a proxy. It would only matter for someone running the corpus download behind a corporate proxy.Verification
ruff checkandruff format --checkonsrc/andtests/passpytest: 113 passeduv lock --checkpassesGenerated by Claude Code