vstorm-co / subagents-pydantic-ai / 30769416466
100%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 16
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 100.0%. Remained the same
30769416466

push

github

web-flow 
chore(deps): close five advisories and give CI least privilege (#75)

Supersedes the five bot pull requests (#69-#74) with one lockfile
resolution, plus the CodeQL finding none of them covered.

Nothing in the published package changes. All five advisories are
against development and documentation dependencies, none of which this
library depends on at run time -- the runtime set is still `pydantic`,
`pydantic-ai-slim` and `typing-extensions`. What was exposed was this
repository's CI and a maintainer's docs build, not anybody's install.
Worth stating plainly so the release is not read as urgent for users.

- urllib3 2.6.3 -> 2.7.0: decompression-bomb safeguards bypassed in
  parts of the streaming API, and sensitive headers forwarded across
  origins in proxied low-level redirects. Both high.
- pymdown-extensions 10.20 -> 11.0.1: path traversal in the `b64`
  extension, and a regression reintroducing the sibling-prefix traversal
  bypass in `pymdownx.snippets` despite `restrict_base_path`.
- requests 2.32.5 -> 2.34.2: insecure temporary-file reuse in
  `extract_zipped_paths()`.
- pytest 9.0.2 -> 9.1.1: vulnerable `tmpdir` handling.
- pygments 2.19.2 -> 2.20.0: ReDoS in the GUID-matching regex.

`ci.yml` had no `permissions` block, so all four of its jobs inherited
the repository default -- which can be write -- and an action compromised
anywhere in the test matrix would have inherited it too. One top-level
`contents: read` closes all four CodeQL alerts. The other three
workflows already declared theirs.

Two of these needed checking rather than trusting. `pymdown-extensions`
is a major bump and the changelog page is a `pymdownx.snippets` include
of `CHANGELOG.md` from outside `docs/` -- precisely what the second
advisory tightened -- so the build was verified by grepping the rendered
HTML for the changelog body, not by its exit code. `pytest` resolved to
9.1.1 rather than the 9.0.3 the advisory names; the suite passes on it.

Constraints in `pyproject... (continued)

1565 of 1565 relevant lines covered (100.0%)

1.0 hits per line

Jobs
ID Job ID Ran Files Coverage
1 30769416466.1 16
100.0
 GitHub Action Run
Source Files on build 30769416466