Skip to content

Fix all open Dependabot Python alerts in Pipfiles#8488

Merged
ihalatci merged 6 commits intomainfrom
chore/dependabot-alerts-python-20260303
Mar 4, 2026
Merged

Fix all open Dependabot Python alerts in Pipfiles#8488
ihalatci merged 6 commits intomainfrom
chore/dependabot-alerts-python-20260303

Conversation

@ihalatci
Copy link
Copy Markdown
Contributor

@ihalatci ihalatci commented Mar 3, 2026

Summary

This PR addresses all currently open Dependabot alerts in this repository by updating vulnerable Python dependencies in both mirrored regression-test environments:

  • src/test/regress/Pipfile / Pipfile.lock
  • .devcontainer/src/test/regress/Pipfile / Pipfile.lock

Updated dependencies

  • cryptography: 44.0.3 -> 46.0.5 (patched: >=46.0.5)
  • Werkzeug: 3.1.4 -> 3.1.5 (patched: >=3.1.5)
  • filelock: resolved to 3.25.0 (patched: >=3.20.3)
  • pyasn1: resolved to 0.6.2 (patched: >=0.6.2)

Alerts covered

Closes Dependabot alerts: #98, #99, #100, #101, #102, #103, #104, #105, #106, #107, #108, #109.

Notes

Lockfiles were regenerated with pipenv lock in both directories to ensure consistent, hashed resolution.

@ihalatci
Copy link
Copy Markdown
Contributor Author

ihalatci commented Mar 3, 2026

Supersedes Dependabot PRs #8444, #8445, #8450, #8452, #8455, #8456, #8474, and #8476 with one consolidated Pipfile/Pipfile.lock security update.

@codecov
Copy link
Copy Markdown

codecov bot commented Mar 3, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.90%. Comparing base (d3330fd) to head (d1c57c7).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #8488      +/-   ##
==========================================
- Coverage   88.91%   88.90%   -0.01%     
==========================================
  Files         286      286              
  Lines       63109    63109              
  Branches     7910     7910              
==========================================
- Hits        56114    56108       -6     
- Misses       4730     4733       +3     
- Partials     2265     2268       +3     
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@ihalatci ihalatci enabled auto-merge (squash) March 4, 2026 11:41
@ihalatci ihalatci merged commit 366fd64 into main Mar 4, 2026
128 checks passed
@ihalatci ihalatci deleted the chore/dependabot-alerts-python-20260303 branch March 4, 2026 11:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants