Skip to content

Bump the dependencies group across 1 directory with 25 updates - #465

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/dependencies-2aaf16bb1b
Open

Bump the dependencies group across 1 directory with 25 updates#465
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/dependencies-2aaf16bb1b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 5, 2026 •
edited by cursor Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 25 updates in the / directory:

Package From To
typer 0.19.2 0.27.2
requests 2.32.5 2.34.2
rich 14.1.0 15.0.0
tqdm 4.67.1 4.70.1
tabulate 0.9.0 0.10.0
pydantic 2.11.9 2.13.5
aiohttp 3.12.15 3.14.3
filelock 3.19.1 4.0.9
eval-type-backport 0.2.2 0.4.0
click 8.3.0 8.5.0
pyarrow 21.0.0 25.0.1
pillow 11.3.0 12.3.0
black 25.9.0 26.5.1
ruff 0.13.2 0.16.10
types-tqdm 4.67.0.20250809 4.70.0.20260906
types-tabulate 0.9.0.20241207 0.10.0.20260508
pre-commit 4.3.0 4.6.2
types-requests 2.32.4.20250913 2.33.0.20260906
pyarrow-stubs 20.0.0.20250825 20.0.0.20260819
mypy 1.18.2 2.4.0
pytest-mock 3.15.1 3.16.0
pytest-asyncio 0.24.0 1.4.0
tox 4.30.2 4.64.7
datasets 4.1.1 5.0.1
transformers 4.56.2 5.18.0

Updates typer from 0.19.2 to 0.27.2

Release notes

Sourced from typer's releases.

0.27.2

Refactors

  • ♻️ Create exceptions module and TyperException base class. PR #1942 by @​svlandeg.

Docs

  • 🐛 Fix showing fast button as external link in animated terminals in docs. PR #1912 by @​phalberg.

Internal

0.27.1

Features

  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.

Docs

Internal

0.27.0

Breaking Changes

Internal

... (truncated)

Changelog

Sourced from typer's changelog.

0.27.2 (2026-08-28)

Refactors

  • ♻️ Create exceptions module and TyperException base class. PR #1942 by @​svlandeg.

Docs

  • 🐛 Fix showing fast button as external link in animated terminals in docs. PR #1912 by @​phalberg.

Internal

0.27.1 (2026-08-03)

Features

  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.

Docs

Internal

0.27.0 (2026-07-15)

Breaking Changes

Internal

... (truncated)

Commits

Updates requests from 2.32.5 to 2.34.2

Release notes

Sourced from requests's releases.

v2.34.2

2.34.2 (2026-05-14)

  • Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2342-2026-05-14

v2.34.1

2.34.1 (2026-05-13)

Bugfixes

  • Widened json input type from dict and list to Mapping and Sequence. (#7436)
  • Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
  • Response.reason moved from str | None to str to improve handling for users. (#7437)
  • Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

New Contributors

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2341-2026-05-13

v2.34.0

2.34.0 (2026-05-11)

Announcements

  • Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

    Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

  • Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
  • Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
  • Requests added support for Python 3.14t. (#7419)

Bugfixes

  • Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
  • Requests no longer performs greedy matching on no_proxy domains. The

... (truncated)

Changelog

Sourced from requests's changelog.

2.34.2 (2026-05-14)

  • Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

2.34.1 (2026-05-13)

Bugfixes

  • Widened json input type from dict and list to Mapping and Sequence. (#7436)
  • Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
  • Response.reason moved from str | None to str to improve handling for users. (#7437)
  • Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

2.34.0 (2026-05-11)

Announcements

  • Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

    Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

  • Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
  • Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
  • Requests added support for Python 3.14t. (#7419)

Bugfixes

  • Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
  • Requests no longer performs greedy matching on no_proxy domains. The proxy_bypass implementation has been updated with CPython's fix from bpo-39057. (#7427)
  • Requests no longer incorrectly strips duplicate leading slashes in URI paths. This should address user issues with specific presigned URLs. Note the full fix requires urllib3 2.7.0+. (#7315)

... (truncated)

Commits

Updates rich from 14.1.0 to 15.0.0

Release notes

Sourced from rich's releases.

The So Long 3.8 Release

A few fixes. The major version bump is to honor the passing of 3.8 support which reached its EOL in October 7, 2024

[15.0.0] - 2026-04-12

Changed

  • Breaking change: Dropped support for Python3.8

Fixed

The Faster Startup Release

No new features in this release, but there should be improved startup time for Rich apps, and potentially improved runtime if you have a lot of links.

[14.3.4] - 2026-04-11

Changed

The infinite Release

Fixed a infinite loop in split_graphemes

[14.3.3] - 2026-02-19

Fixed

The ZWJy release

A fix for cell_len edge cases

[14.3.2] - 2026-02-01

Fixed

The Nerdy Fix release

Fixed issue with characters outside of unicode range reporting 0 cell size

[14.3.1] - 2026-01-24

... (truncated)

Changelog

Sourced from rich's changelog.

[15.0.0] - 2026-04-12

Changed

  • Breaking change: Dropped support for Python3.8

Fixed

[14.3.4] - 2026-04-11

Changed

[14.3.3] - 2026-02-19

Fixed

[14.3.2] - 2026-02-01

Fixed

[14.3.1] - 2026-01-24

Fixed

[14.3.0] - 2026-01-24

Fixed

Added

... (truncated)

Commits

Updates tqdm from 4.67.1 to 4.70.1

Release notes

Sourced from tqdm's releases.

tqdm v4.70.1 stable

  • contrib.concurrent: fix no-len iterables (#1830 <- #1828)
  • tests: major overhaul (#1819)
  • update AI policy in PR template
  • misc lint & tidy
  • CI: bump workflow actions & pre-commit hooks

tqdm v4.70.0 stable

  • contrib.concurrent: major improvements
    • support process_map(mp_context, max_tasks_per_child), thread_map(thread_name_prefix) (#1265)
    • fix total based on shortest iterable length (#1473)
    • use default max_workers (#1543 <- #1530, #1518)
    • support timeout, buffersize (#1576)
    • improve ETA (#1708 <- #1161)
    • update as_completed (#1709 <- #1565)
    • add tqdm.concurrent.intepreter_map (#1777)
  • asyncio: support iterables with only __aiter__ (#1714 <- #1686)
  • support reset(float("inf")) (#1783 <- #1781, #651)
  • framework: test & reduce wheel size (#1782)

tqdm v4.69.1 stable

tqdm v4.69.0 stable

  • add tqdm.asyncio.gather(..., return_exceptions=False) (#1776, #1671 <- #1286)
  • misc minor framework updates
    • bump workflow actions & pre-commit hooks

tqdm v4.68.4 stable

tqdm v4.68.3 stable

  • utils: delay os.get_terminal_size (#1763 <- #1760)
  • autonotebook: support QtConsole, Spyder, JupyterLite (#1763, #1628, #1559 <- #1283, #1098, #512)
  • minor docs updates
    • fix typo (#1762)
    • use git-fame
  • misc minor framework updates
    • fix & update CI build
    • pre-commit: add docs & metadata generation
    • move tox.ini -> pyproject.toml, move tox-gh-actions -> tox-gh
    • add Python 3.14, drop 3.7 support

... (truncated)

Commits

Updates tabulate from 0.9.0 to 0.10.0

Changelog

Sourced from tabulate's changelog.

  • 0.10.0: Add support for Python 3.11, 3.12, 3.13, 3.14. Drop support for Python 3.7, 3.8, 3.9. PRESERVE_STERILITY global is replaced with preserve_sterility function argument. New formatting options: headersglobalalign, headersalign, colglobalalign. New output format: colon_grid (Pandoc grid_tables with alignment) Various bug fixes. Improved error messages.
Commits
  • 3b4cd50 update HOWTOPUBLISH
  • 35ee0f6 update mini-benchmark table
  • 37ac76e restore tabulate.version
  • 37e1ed0 move # nowa: E931 to a different line (flake8)
  • 7bacc90 run pre-commit hooks (black)
  • 1b69704 Remove spurious cast in string interpolation
  • 4d535af Use specific noqa directives
  • 76c3d37 Remove spurious space from error message
  • 13508e7 Unnecessary list call
  • 69f67cd Do not call getattr with a constant value
  • Additional commits viewable in compare view

Updates pydantic from 2.11.9 to 2.13.5

Release notes

Sourced from pydantic's releases.

v2.13.5 (2026-08-28)

What's Changed

Fixes

  • Allow reuse of validators when plugins are set by @​Viicos in #13535
  • Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
  • Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
  • Count validated model fields once in smart unions by @​tamird in #13731

v2.13.4 2026-05-06

v2.13.4 (2026-05-06)

What's Changed

Packaging

Fixes

Full Changelog: pydantic/pydantic@v2.13.3...v2.13.4

v2.13.3 2026-04-20

v2.13.3 (2026-04-20)

What's Changed

Fixes

Full Changelog: pydantic/pydantic@v2.13.2...v2.13.3

v2.13.2 2026-04-17

v2.13.2 (2026-04-17)

What's Changed

Fixes

  • Fix ValidationInfo.field_name missing with model_validate_json() by @​Viicos in #13084

Full Changelog: pydantic/pydantic@v2.13.1...v2.13.2

v2.13.1 2026-04-15

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.13.5 (2026-08-28)

GitHub release

What's Changed

Fixes

  • Allow reuse of validators when plugins are set by @​Viicos in #13535
  • Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
  • Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
  • Count validated model fields once in smart unions by @​tamird in #13731

v2.13.4 (2026-05-06)

GitHub release

What's Changed

Packaging

Fixes

v2.13.3 (2026-04-20)

GitHub release

What's Changed

Fixes

v2.13.2 (2026-04-17)

GitHub release

What's Changed

Fixes

  • Fix ValidationInfo.field_name missing with model_validate_json() by @​Viicos in #13084

v2.13.1 (2026-04-15)

... (truncated)

Commits
  • 001dea0 Bump pypa/gh-action-pypi-publish action to v1.14.2
  • 558379f Bump twine to v7.0.0
  • 2cfd5d3 Do not check for docs build
  • a735bee Fix more Clippy lints
  • 7eed4a1 Fix Clippy 0.1.95 warnings
  • b353bbb Prepare release v2.13.5
  • 63d2ccc Count validated model fields once in smart unions
  • a53ec2e Speed up PyPy CI tests
  • d65e0f9 Workaround circular import error in Mypy
  • 47a6dbf Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer
  • Additional commits viewable in compare view

Updates aiohttp from 3.12.15 to 3.14.3
Updates filelock from 3.19.1 to 4.0.9

Release notes

Sourced from filelock's releases.

4.0.9

What's Changed

New Contributors

Full Changelog: tox-dev/filelock@4.0.8...4.0.9

4.0.8

What's Changed

Full Changelog: tox-dev/filelock@4.0.7...4.0.8

4.0.7

What's Changed

Full Changelog: tox-dev/filelock@4.0.6...4.0.7

4.0.6

What's Changed

Full Changelog: tox-dev/filelock@4.0.5...4.0.6

4.0.5

What's Changed

New Contributors

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.0.11 (2026-10-05)

  • ReadWriteLock and AsyncReadWriteLock use a validated private hard link when /dev/fd has no entry for the database descriptor, supporting NetBSD's static descriptor directory beyond descriptor 63. The temporary location must share a filesystem with the database. The symlink refusal test accepts NetBSD's error wording.

4.0.10 (2026-10-03)

  • Reusing a singleton AsyncFileLock with another loop, executor or run_in_executor, or a singleton SoftFileLease with another lease_duration, heartbeat_interval or on_compromise, now raises ValueError instead of returning the lock with its original options. :pr:765

4.0.9 (2026-10-01)

  • ReadWriteLock and AsyncReadWriteLock close the descriptor that checks the database path once SQLite has connected, so on PyPy a dropped lock leaves no descriptor open until garbage collection runs. :pr:763
  • ReadWriteLock and AsyncReadWriteLock refuse a symlink at the database path instead of following it, so a user who can create names in a shared lock directory cannot point the lock at another file (GHSA-j8f7-rjxc-mr56).

4.0.8 (2026-10-01)

  • ReadWriteLock.release() and SoftReadWriteLock.release() from a thread that does not hold the write lock now raise RuntimeError instead of dropping the holder's lock and letting a second writer in. :pr:761

4.0.7 (2026-09-29)

  • File locks now raise ValueError at construction when mode denies the owner read or write, such as mode=0o444, instead of failing on a later acquire and staying broken until someone deletes the lock file. :pr:760

4.0.6 (2026-09-28)

... (truncated)

Commits
  • 7b00bb8 Release 4.0.9
  • 4944624 🐛 fix(read-write): close db fd after connect (#763)
  • 162060e 📝 docs(util): correct write and break guarantees (#762)
  • 4d45e83 Merge commit from fork
  • 9376e9b Release 4.0.8
  • 34f4657 🐛 fix(read-write): refuse cross-thread write release (#761)
  • 9ed62ac Release 4.0.7
  • 2f2c4a7 🐛 fix(mode): require owner read and write (#760)
  • d4ffe9c build(deps): bump astral-sh/setup-uv from 10.1.0 to 10.2.0 in the github-acti...
  • 61ce360 Release 4.0.6
  • Additional commits viewable in compare view

Updates eval-type-backport from 0.2.2 to 0.4.0

Commits

Updates click from 8.3.0 to 8.5.0

Release notes

Sourced from click's releases.

8.5.0

This is the Click 8.5.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecation, or introduce potentially breaking changes.

We encourage everyone to upgrade. You can read more about our Version Support Policy on our website.

PyPI: https://pypi.org/project/click/8.5.0/ Changes: https://click.palletsprojects.com/page/changes/#version-8-5-0 Milestone https://github.com/pallets/click/milestone/33

  • Add built-in shell completion support for PowerShell (Windows PowerShell 5.1+ and pwsh 7+) alongside the existing bash, zsh, and fish completers. Use _FOO_BAR_COMPLETE=powershell_source foo-bar to generate the completion script. #2672 #3637
  • Supported versions of Windows enable ANSI terminal styles by default. Colorama is no longer a dependency and is not used. #2986 #3505
  • {class}Argument accepts a help parameter, and help output includes a Positional arguments section when argument help is available. #2983 #3473
  • confirm() and prompt() strip ANSI color and style codes from the prompt when the output stream does not support them, matching echo(). This stripping was lost in 8.4.0 when #2969 began writing the prompt with input() directly. #3572 #3653
  • {class}Path with allow_dash=True no longer triggers a BytesWarning, an error under python -bb, when checking a value against the - convention. #2877 #3642
  • Add {func}custom_version_option, a --version option whose output is produced by a callback, covering cases {func}version_option intentionally does not. The feature set of {func}version_option is now frozen; see [discussion #3527](`@version_option` future direction pallets/click#3527). #3581
  • style() and secho() no longer silently drop the 256-color index 0 (black) passed as fg or bg, and now validate color arguments. Invalid colors raise a ValueError instead of a TypeError. #3677
  • The automatic help option stores its value under the reserved name _click_default_help instead of help, so a parameter named help no longer breaks parsing. The new name is visible in {meth}Command.to_info_dict output. Parameters that overwrite each other's value trigger a warning: an argument sharing its name with another parameter, or any parameter claiming the reserved name. Options may still share a name to compete for the same value (feature switches). #2819 #3678
  • unstyle and the ANSI handling behind help-text wrapping now strip the full CSI escap...

    Description has been truncated

    [!NOTE]
    Medium Risk
    Broad upgrades include major bumps (filelock 4, transformers/datasets 5, mypy 2, pytest-asyncio 1.x) and typer CLI behavior changes; validation depends on CI and lockfile resolution without accompanying code fixes in this PR.

    Overview
    Bumps Poetry version constraints across main, quality, test, and examples dependency groups in pyproject.toml (~25 packages), with no application source changes in this diff.

    Runtime / CLI stack: tighter pins for typer (0.27.x, includes metavar help breaking change), click, rich (15.x), requests, aiohttp, pydantic, tqdm, tabulate (0.10.x), filelock (4.x), eval-type-backport, optional pyarrow, pillow, and black.

    Dev tooling: quality group moves to black 26.x, ruff 0.16.x, mypy 2.x, updated types stubs, and pre-commit 4.6.2; tests group bumps pytest-asyncio to 1.4.x, pytest-mock, and tox.

    Examples-only: datasets constrained to 5.x and transformers to 5.x (major-line upgrades for optional example installs).

    Reviewed by Cursor Bugbot for commit b9e5067. Bugbot is set up for automated code reviews on this repo. Configure here.

@dependabot
Bump the dependencies group across 1 directory with 25 updates
b9e5067 
---
updated-dependencies:
- dependency-name: typer
  dependency-version: 0.27.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: requests
  dependency-version: 2.34.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: rich
  dependency-version: 15.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: tqdm
  dependency-version: 4.70.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: tabulate
  dependency-version: 0.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: pydantic
  dependency-version: 2.13.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: aiohttp
  dependency-version: 3.14.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: filelock
  dependency-version: 4.0.9
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: eval-type-backport
  dependency-version: 0.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: click
  dependency-version: 8.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: pyarrow
  dependency-version: 25.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: pillow
  dependency-version: 12.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: black
  dependency-version: 26.5.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: ruff
  dependency-version: 0.16.10
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: types-tqdm
  dependency-version: 4.70.0.20260906
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: types-tabulate
  dependency-version: 0.10.0.20260508
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: pre-commit
  dependency-version: 4.6.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: types-requests
  dependency-version: 2.33.0.20260906
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: pyarrow-stubs
  dependency-version: 20.0.0.20260819
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: mypy
  dependency-version: 2.4.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: pytest-mock
  dependency-version: 3.16.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: pytest-asyncio
  dependency-version: 1.4.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: tox
  dependency-version: 4.64.7
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: datasets
  dependency-version: 5.0.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: transformers
  dependency-version: 5.18.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 5, 2026
@broly-code-security-scanner

broly-code-security-scanner Bot commented Oct 5, 2026

Copy link
Copy Markdown

Broly Security Scan

Note

Summary

4 actionable finding(s) in this PR

  • 🟡 4 medium

Main table: 4 shown, 0 omitted of 4 actionable finding(s) above the reporting threshold. See the repository Security tab for the full set.

No finding is at or above high, so this check is not blocking. The findings above are still tracked and reported.

Severity Scanner Issue Location Dismiss Verdict
🟡 MEDIUM SCA urllib3@2.4.0 — 16 vulnerabilities (worst:
GHSA-2xpw-w6gg-jr37)		 poetry.lock:1 d4 🔺 TRUE_POSITIVE · Confidence: HIGH
🟡 MEDIUM SCA pygments@2.19.1 — 2 vulnerabilities (worst:
GHSA-5239-wwwm-4pmq)
→ fixed in 2.20.0		 poetry.lock:1 d2 🔺 TRUE_POSITIVE · Confidence: HIGH
🟡 MEDIUM SCA idna@3.10 — 2 vulnerabilities (worst:
GHSA-65pc-fj4g-8rjx)
→ fixed in 3.15		 poetry.lock:1 d1 🔺 TRUE_POSITIVE · Confidence: HIGH
🟡 MEDIUM SCA pytest@8.4.2 — 2 vulnerabilities (worst:
GHSA-6w46-j5rx-g56g)
→ fixed in 9.0.3		 poetry.lock:1 d3 🔺 TRUE_POSITIVE · Confidence: MEDIUM

Dismiss false positives

Tick a box to dismiss the finding; untick it to bring the finding back. That is the same as replying /broly dismiss d1 and /broly undismiss d1. To record why it is a false positive, reply with /broly dismiss d1: your reason instead — Broly reuses those reasons to triage similar findings across the org.

  • d1 · 🟡 MEDIUM   · poetry.lock:1 · idna@3.10 — 2 vulnerabilities (worst: GHSA-65pc-fj4g-8rjx)
  • d2 · 🟡 MEDIUM   · poetry.lock:1 · pygments@2.19.1 — 2 vulnerabilities (worst: GHSA-5239-wwwm-4pmq)
  • d3 · 🟡 MEDIUM   · poetry.lock:1 · pytest@8.4.2 — 2 vulnerabilities (worst: GHSA-6w46-j5rx-g56g)
  • d4 · 🟡 MEDIUM   · poetry.lock:1 · urllib3@2.4.0 — 16 vulnerabilities (worst: GHSA-2xpw-w6gg-jr37)

Note

Re-scan this PR anytime with /broly scan — useful after /broly undismiss, or to refresh findings without a new push.

Broly — SAST (GLM-5.3-Flash) · Secrets · SCA · IaC · GH Actions · Base Images · Supply Chain Threats · Attack Hypotheses · Adversarial Verification

We're continuously improving Broly's accuracy and finding quality — your feedback is valuable. False positives, missed findings, bugs, and feature requests all welcome.

Ask in #security-engineering   Powered by Together AI

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants