chore(run/markdown-preview): bump bleach to 6.4.0 to fix dependabot alert#14391
chore(run/markdown-preview): bump bleach to 6.4.0 to fix dependabot alert#14391XrossFox wants to merge 1 commit into
Conversation
…alert - Bumped `bleach` to 6.4.0 in `run/markdown-preview/renderer/requirements.txt` to address a Dependabot vulnerability. - Removed Python version constraints for `bleach` and `pytest`.
product-auto-label
Bot
added
api: run
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request simplifies dependency requirements by removing Python version constraints for pytest in requirements-test.txt and consolidating bleach to version 6.4.0 in requirements.txt. Feedback is provided regarding the bleach library, which is deprecated, suggesting a future migration to an actively maintained alternative like nh3 to ensure long-term security.
| Markdown==3.7 | ||
| bleach==6.2.0; python_version >= "3.9" | ||
| bleach==6.1.0; python_version <= "3.8" | ||
| bleach==6.4.0 |
There was a problem hiding this comment.
The bleach library is officially deprecated and no longer maintained as of June 2026 [3.3.2]. Since it is used for HTML sanitization (a security-critical task), please consider migrating to an actively maintained alternative like nh3 in a future pull request to ensure long-term security and support.
References
- When upgrading core dependencies, if an incompatible library is no longer supported, proceed with the core upgrade and defer the refactoring or replacement of the unsupported library to a later time.
1 participant
Description
bleachto 6.4.0 inrun/markdown-preview/renderer/requirements.txtto address a Dependabot vulnerability.bleachandpytest.Fixes b/532239091
Checklist
Testing
Compliance & Style
Post-Approval Actions