Skip to content

Commit c7a31ea

Browse files
vdusekclaude
andcommitted
fix: override vulnerable black transitive dependency
pydoc-markdown is unmaintained and pins old docspec-python with a vulnerable version of black. We explicitly constrain black>=24.3.0 to override the transitive dependency and resolve the dependabot security alert. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent 56aa42e commit c7a31ea

2 files changed

Lines changed: 82 additions & 22 deletions

File tree

pyproject.toml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,11 @@ scrapy = ["scrapy>=2.11.0"]
6464

6565
[dependency-groups]
6666
dev = [
67+
# TODO: Remove this constraint once pydoc-markdown updates its dependencies.
68+
# Package pydoc-markdown is unmaintained and pins old docspec-python with vulnerable black.
69+
# See https://github.com/apify/apify-client-python/pull/582/ for more details.
70+
# We explicitly constrain black>=24.3.0 to override the transitive dependency.
71+
"black>=24.3.0",
6772
"build<2.0.0",
6873
"crawlee[parsel]",
6974
"dycw-pytest-only<3.0.0",

0 commit comments

Comments
 (0)