Repository navigation
Conversation
The image shipped 3.1.57, which Dependabot flags with 14 advisories (1 critical, 9 high), all fixed by 3.1.62. Dependabot's own PR (#23) could not be rebased onto the CI fix because pip has no entry in dependabot.yml, so the bump is made here by hand. Only the gitpython pin and its hashes change in the lock; 3.1.62 has the same dependencies as 3.1.57. The floor in requirements.txt moves with it so the next `make lock` cannot resolve back to a vulnerable version.
Security updates were already opening pip PRs, but with no pip entry in dependabot.yml Dependabot refused to rebase them, which is why the GitPython fix (#23) had to be redone by hand. Add the entry with open-pull-requests-limit: 0: scheduled pip bumps stay off, security PRs keep coming and can now be rebased. Also record today's changes in the changelog: the GitPython security bump, this entry, and the types job moving onto the lock.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Security patch on the current minor, as SECURITY.md promises: GitPython 3.1.57 -> 3.1.62 closes 14 advisories in the published image. Also ships the CI and Dependabot fixes made on the way there. The pin examples in README and docker-compose move to 1.0.1 so they no longer point at the vulnerable image.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
open-pull-requests-limit: 0(3da86fd): scheduled pip bumps stay off, security PRs can now be rebased. CHANGELOG updated for today's changes.The image picks up the GitPython fix with the next release.