Skip to content

chore(deps): Cherry pick CVE soupsieve json repair transformers lts 1.13.x - #38906

Merged
wylswz merged 3 commits into
langgenius:lts/1.13.xfrom
wylswz:cherry-pick-cve-soupsieve-json-repair-transformers-lts-1.13.x
Jul 14, 2026
Merged

chore(deps): Cherry pick CVE soupsieve json repair transformers lts 1.13.x#38906
wylswz merged 3 commits into
langgenius:lts/1.13.xfrom
wylswz:cherry-pick-cve-soupsieve-json-repair-transformers-lts-1.13.x

Conversation

@wylswz

@wylswz wylswz commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Important

  1. Make sure you have read our contribution guidelines
  2. Ensure there is an associated issue and you have been assigned to it
  3. Use the correct syntax to link this PR: Fixes #<issue number>.

Summary

Screenshots

Before After
... ...

Checklist

  • This change requires a documentation update, included: Dify Document
  • I understand that this PR may be closed in case there was no previous discussion or issues. (This doesn't apply to typos!)
  • I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
  • I've updated the documentation accordingly.
  • I ran make lint && make type-check (backend) and cd web && pnpm exec vp staged (frontend) to appease the lint gods

dependabot Bot and others added 2 commits July 14, 2026 15:00
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit ca46d07)
@wylswz
wylswz requested a review from a team July 14, 2026 07:06
@wylswz
wylswz requested a review from QuantumGhost as a code owner July 14, 2026 07:06
@dosubot dosubot Bot added size:XS This PR changes 0-9 lines, ignoring generated files. dependencies Pull requests that update a dependency file labels Jul 14, 2026
…us#38877)

Fixes CVE-2026-5241 (Inclusion of Functionality from Untrusted Control Sphere, CVSS 8.0).

(cherry picked from commit 94f7ed4)
@wylswz
wylswz force-pushed the cherry-pick-cve-soupsieve-json-repair-transformers-lts-1.13.x branch from ed01269 to 1a9ff41 Compare July 14, 2026 07:50
@wylswz
wylswz requested a review from laipz8200 as a code owner July 14, 2026 07:50
@github-actions

Copy link
Copy Markdown
Contributor

Pyrefly Diff

base → PR
--- /tmp/pyrefly_base.txt	2026-07-14 07:51:37.102575566 +0000
+++ /tmp/pyrefly_pr.txt	2026-07-14 07:51:23.655574206 +0000
@@ -1723,9 +1723,9 @@
 ERROR Object of class `FunctionType` has no attribute `assert_called_once_with` [missing-attribute]
   --> tests/unit_tests/commands/test_upgrade_db.py:85:5
 ERROR Object of class `ModuleType` has no attribute `redis_client` [missing-attribute]
-  --> tests/unit_tests/conftest.py:48:13
+  --> tests/unit_tests/conftest.py:58:13
 ERROR Object of class `ModuleType` has no attribute `pubsub_redis_client` [missing-attribute]
-  --> tests/unit_tests/conftest.py:50:13
+  --> tests/unit_tests/conftest.py:60:13
 ERROR No attribute `MethodView` in module `builtins` [missing-attribute]
  --> tests/unit_tests/controllers/common/test_fields.py:9:5
 ERROR Object of class `int` has no attribute `lower` [missing-attribute]

@github-actions

Copy link
Copy Markdown
Contributor

Pyrefly Type Coverage

Metric Base PR Delta
Type coverage 0.00% 0.00% 0.00%
Strict coverage 0.00% 0.00% 0.00%
Typed symbols 0 0 0
Untyped symbols 0 0 0
Modules 0 0 0

@dosubot dosubot Bot added the lgtm This PR has been approved by a maintainer label Jul 14, 2026
@wylswz
wylswz merged commit 71d2d9e into langgenius:lts/1.13.x Jul 14, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file lgtm This PR has been approved by a maintainer size:XS This PR changes 0-9 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants