From 787250b45ebbecc16e0cc2a2df0e1fb8639489ee Mon Sep 17 00:00:00 2001 From: "aieng-bot[bot]" Date: Tue, 31 Mar 2026 00:33:56 +0000 Subject: [PATCH] Bump pip from 25.3 to 26.0 and clean up pyproject.toml - Bump pip to >=26.0 in dev dependencies to address GHSA-4xh5-x5gv-qwph - Remove duplicate tornado and pillow entries introduced by previous bot runs - Remove pip from main dependencies (it belongs only in dev group) - Update virtualenv to >=20.36.2 to address CVE-2026-22702 - Regenerate uv.lock Co-authored-by: aieng-bot --- pyproject.toml | 5 +---- uv.lock | 30 +++++++++++++++++++++--------- 2 files changed, 22 insertions(+), 13 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index d8607cc..e8a46e8 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -14,10 +14,7 @@ dependencies = [ "pygments>=2.20.0", # Pinning version to address vulnerability CVE-2026-4539 "tornado>=6.5.5", # Pinning version to address vulnerabilities GHSA-78cv-mqj4-43f7, CVE-2026-31958 "werkzeug>=3.1.6", # Pinning version to address vulnerabilities GHSA-hgf8-39gv-g3f2, CVE-2026-21860, CVE-2026-27199 - "virtualenv>=20.36.1", # TODO: Update to >=20.36.2 when released to address CVE-2026-22702 - "tornado>=6.5.5", # Pinning version to address vulnerabilities GHSA-78cv-mqj4-43f7, CVE-2026-31958 - "pillow>=12.1.1", # Pinning version to address vulnerability CVE-2026-25990 - "pip>=26.0", # Pinning version to address vulnerability CVE-2026-1703 + "virtualenv>=20.36.2", # Pinning version to address CVE-2026-22702 "absl-py>=2.3.1", "python-dotenv>=1.0.0", "func-timeout>=4.3.5", diff --git a/uv.lock b/uv.lock index c138740..7afdef9 100644 --- a/uv.lock +++ b/uv.lock @@ -718,11 +718,11 @@ wheels = [ [[package]] name = "filelock" -version = "3.20.3" +version = "3.25.2" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/1d/65/ce7f1b70157833bf3cb851b556a37d4547ceafc158aa9b34b36782f23696/filelock-3.20.3.tar.gz", hash = "sha256:18c57ee915c7ec61cff0ecf7f0f869936c7c30191bb0cf406f1341778d0834e1", size = 19485, upload-time = "2026-01-09T17:55:05.421Z" } +sdist = { url = "https://files.pythonhosted.org/packages/94/b8/00651a0f559862f3bb7d6f7477b192afe3f583cc5e26403b44e59a55ab34/filelock-3.25.2.tar.gz", hash = "sha256:b64ece2b38f4ca29dd3e810287aa8c48182bbecd1ae6e9ae126c9b35f1382694", size = 40480, upload-time = "2026-03-11T20:45:38.487Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/b5/36/7fb70f04bf00bc646cd5bb45aa9eddb15e19437a28b8fb2b4a5249fac770/filelock-3.20.3-py3-none-any.whl", hash = "sha256:4b0dda527ee31078689fc205ec4f1c1bf7d56cf88b6dc9426c4f230e46c2dce1", size = 16701, upload-time = "2026-01-09T17:55:04.334Z" }, + { url = "https://files.pythonhosted.org/packages/a4/a5/842ae8f0c08b61d6484b52f99a03510a3a72d23141942d216ebe81fefbce/filelock-3.25.2-py3-none-any.whl", hash = "sha256:ca8afb0da15f229774c9ad1b455ed96e85a81373065fb10446672f64444ddf70", size = 26759, upload-time = "2026-03-11T20:45:37.437Z" }, ] [[package]] @@ -1459,7 +1459,6 @@ dependencies = [ { name = "openai" }, { name = "pandas" }, { name = "pillow" }, - { name = "pip" }, { name = "ply" }, { name = "protobuf" }, { name = "psutil" }, @@ -1530,7 +1529,6 @@ requires-dist = [ { name = "openai", specifier = ">=1.93.0" }, { name = "pandas", specifier = ">=2.2.3" }, { name = "pillow", specifier = ">=12.1.1" }, - { name = "pip", specifier = ">=26.0" }, { name = "ply", specifier = ">=3.11" }, { name = "protobuf", specifier = ">=3.20.3" }, { name = "psutil", specifier = ">=7.0.0" }, @@ -1558,7 +1556,7 @@ requires-dist = [ { name = "transformers", specifier = ">=4.30.0" }, { name = "urllib3", specifier = "==2.6.3" }, { name = "vcrpy", specifier = ">=7.0.0" }, - { name = "virtualenv", specifier = ">=20.36.1" }, + { name = "virtualenv", specifier = ">=20.36.2" }, { name = "werkzeug", specifier = ">=3.1.6" }, ] @@ -2862,6 +2860,19 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/ec/57/56b9bcc3c9c6a792fcbaf139543cee77261f3651ca9da0c93f5c1221264b/python_dateutil-2.9.0.post0-py2.py3-none-any.whl", hash = "sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427", size = 229892, upload-time = "2024-03-01T18:36:18.57Z" }, ] +[[package]] +name = "python-discovery" +version = "1.2.1" +source = { registry = "https://pypi.org/simple" } +dependencies = [ + { name = "filelock" }, + { name = "platformdirs" }, +] +sdist = { url = "https://files.pythonhosted.org/packages/b9/88/815e53084c5079a59df912825a279f41dd2e0df82281770eadc732f5352c/python_discovery-1.2.1.tar.gz", hash = "sha256:180c4d114bff1c32462537eac5d6a332b768242b76b69c0259c7d14b1b680c9e", size = 58457, upload-time = "2026-03-26T22:30:44.496Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/67/0f/019d3949a40280f6193b62bc010177d4ce702d0fce424322286488569cd3/python_discovery-1.2.1-py3-none-any.whl", hash = "sha256:b6a957b24c1cd79252484d3566d1b49527581d46e789aaf43181005e56201502", size = 31674, upload-time = "2026-03-26T22:30:43.396Z" }, +] + [[package]] name = "python-dotenv" version = "1.2.1" @@ -3986,16 +3997,17 @@ wheels = [ [[package]] name = "virtualenv" -version = "20.36.1" +version = "21.2.0" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "distlib" }, { name = "filelock" }, { name = "platformdirs" }, + { name = "python-discovery" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/aa/a3/4d310fa5f00863544e1d0f4de93bddec248499ccf97d4791bc3122c9d4f3/virtualenv-20.36.1.tar.gz", hash = "sha256:8befb5c81842c641f8ee658481e42641c68b5eab3521d8e092d18320902466ba", size = 6032239, upload-time = "2026-01-09T18:21:01.296Z" } +sdist = { url = "https://files.pythonhosted.org/packages/aa/92/58199fe10049f9703c2666e809c4f686c54ef0a68b0f6afccf518c0b1eb9/virtualenv-21.2.0.tar.gz", hash = "sha256:1720dc3a62ef5b443092e3f499228599045d7fea4c79199770499df8becf9098", size = 5840618, upload-time = "2026-03-09T17:24:38.013Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/6a/2a/dc2228b2888f51192c7dc766106cd475f1b768c10caaf9727659726f7391/virtualenv-20.36.1-py3-none-any.whl", hash = "sha256:575a8d6b124ef88f6f51d56d656132389f961062a9177016a50e4f507bbcc19f", size = 6008258, upload-time = "2026-01-09T18:20:59.425Z" }, + { url = "https://files.pythonhosted.org/packages/c6/59/7d02447a55b2e55755011a647479041bc92a82e143f96a8195cb33bd0a1c/virtualenv-21.2.0-py3-none-any.whl", hash = "sha256:1bd755b504931164a5a496d217c014d098426cddc79363ad66ac78125f9d908f", size = 5825084, upload-time = "2026-03-09T17:24:35.378Z" }, ] [[package]]