From 552951bb1cb20ca0ba4d273bc461bdffa0fe0cfb Mon Sep 17 00:00:00 2001 From: Nikolay Petrov Date: Wed, 21 Oct 2026 16:01:15 -0700 Subject: [PATCH 1/2] ci(locks): bump virtualenv to 21.14.12 for CVE-2026-113722 pip-audit flags virtualenv 21.14.7 in the tools lock; the fix is 21.14.9. The release is under the 7-day cooldown, so virtualenv gets the same per-package exemption as certifi and uv. Signed-off-by: Nikolay Petrov --- dokimi/requirements-ci.lock.txt | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/dokimi/requirements-ci.lock.txt b/dokimi/requirements-ci.lock.txt index 6dcc1325..6dadde46 100644 --- a/dokimi/requirements-ci.lock.txt +++ b/dokimi/requirements-ci.lock.txt @@ -1,5 +1,5 @@ # This file was autogenerated by uv via the following command: -# uv pip compile requirements-ci.txt --constraint=requirements.lock.txt --universal --python-version=3.11 --exclude-newer=P7D --exclude-newer-package=certifi=false --exclude-newer-package=uv=false --generate-hashes --output-file=requirements-ci.lock.txt +# uv pip compile requirements-ci.txt --constraint=requirements.lock.txt --universal --python-version=3.11 --exclude-newer=P7D --exclude-newer-package=certifi=false --exclude-newer-package=uv=false --exclude-newer-package=virtualenv=false --generate-hashes --output-file=requirements-ci.lock.txt ast-serialize==0.13.0 \ --hash=sha256:017ddd4f22e727ef93e66df2d53340a6ff809b7e34cc2218f67918ae6239aad0 \ --hash=sha256:12441bc7e41e495db5634c98adc8f8886b619ce2f1e68effe3f792a2adca9f47 \ @@ -1611,9 +1611,9 @@ uv==0.13.4 \ --hash=sha256:e90ab42825587821096cb0d071e387468da38cfa22818c91f9c0b3c0453048e8 \ --hash=sha256:fb0e2028d9a8929884344afb7d91d0f65d9783f640d28aede89fca3602bedde9 # via -r requirements-ci.txt -virtualenv==21.14.7 \ - --hash=sha256:3769219a308c5d2f093e7729621ad12a6346b5767a7ec4338414e2a0fb0c526b \ - --hash=sha256:5f427d56f39eb7e7447d641dd4b7ab1e9c92793f498f35f26da2e4972c5546ae +virtualenv==21.14.12 \ + --hash=sha256:7820aeaef23f1f59a96458edfc7f9d3deac937155718de15f1c9a64471e15551 \ + --hash=sha256:bbcfb78e36c22ad70c6917c4aecb5e63477d3c138e9f88c946f320e31859c76a # via pre-commit zipp==4.1.1 ; python_full_version < '3.12' and platform_machine != 'ppc64le' and platform_machine != 's390x' \ --hash=sha256:7ebb7a44c021b29fd8dbd7cce6812d0d7b5b454521f93cc71af6ccd155aaa70b \ From bc23be4f275fc919f546493eedc1882f1f79950e Mon Sep 17 00:00:00 2001 From: Nikolay Petrov Date: Wed, 21 Oct 2026 16:31:48 -0700 Subject: [PATCH 2/2] test(locks): allow the virtualenv cooldown exemption Signed-off-by: Nikolay Petrov --- dokimi/tests/test_dependency_locks.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/dokimi/tests/test_dependency_locks.py b/dokimi/tests/test_dependency_locks.py index 74b9b521..870fc9c1 100644 --- a/dokimi/tests/test_dependency_locks.py +++ b/dokimi/tests/test_dependency_locks.py @@ -176,7 +176,8 @@ def test_lock_refresh_keeps_the_seven_day_cooldown(name: str) -> None: def test_tools_lock_exempts_only_pins_younger_than_the_cooldown() -> None: - """certifi comes from the main lock (a security bump) and uv is an exact pin in requirements-ci.txt.""" + """certifi comes from the main lock (a security bump), uv is an exact pin in requirements-ci.txt, + and virtualenv is a security bump (CVE-2026-113722).""" cmd = header_command("requirements-ci.lock.txt") exempt = {a.split("=", 1)[1] for a in cmd if a.startswith("--exclude-newer-package=")} - assert exempt == {"certifi=false", "uv=false"}, exempt + assert exempt == {"certifi=false", "uv=false", "virtualenv=false"}, exempt