Skip to content

v1.3.1 - Security Updates

Choose a tag to compare

View all tags
@mxcoppell mxcoppell released this 08 Jan 23:52
· 8 commits to main since this release
v1.3.1
81848f9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security Fixes

This release addresses critical Dependabot security vulnerabilities:

Security

  • urllib3: Updated from 2.6.2 to 2.6.3
    • Fixes CVE-2026-21441 (HIGH severity): Decompression-bomb safeguards bypassed when following HTTP redirects
  • filelock: Updated from 3.17.0 to 3.20.2
    • Fixes CVE-2025-68146 (MEDIUM severity): TOCTOU race condition allowing symlink attacks

Dependencies

  • Updated 28 additional dependencies for improved security and stability

Testing

  • ✅ All 350 tests passing
  • No breaking changes

Dependabot Alerts Resolved

  • Alert #10 (urllib3)
  • Alert #9 (filelock)

Full Changelog: v1.3.0...v1.3.1

Assets 2
Loading