Skip to content

fix: bump dependencies to mitigate high-severity vulnerabilities#60

Merged
thomasht86 merged 2 commits intomainfrom
copilot/bump-dependencies-to-mitigate-vulnerabilities
Apr 14, 2026
Merged

fix: bump dependencies to mitigate high-severity vulnerabilities#60
thomasht86 merged 2 commits intomainfrom
copilot/bump-dependencies-to-mitigate-vulnerabilities

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Apr 14, 2026

Addresses 4 high-severity Dependabot alerts by updating transitive dependencies in lock files.

  • quinn-proto 0.11.13 → 0.11.14 (Cargo.lock) — unauthenticated remote DoS via QUIC transport parameter parsing
  • pillow 12.1.1 → 12.2.0 (uv.lock) — PSD out-of-bounds write + FITS GZIP decompression bomb
  • cbor2 5.8.0 → 5.9.0 (uv.lock) — DoS via uncontrolled recursion in cbor2.loads

pillow 11.3.0 remains under the python_full_version < '3.10' marker — no patched 11.x exists since Pillow 12.x dropped Python 3.9.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • invalid-proxy-host-12345.invalid
    • Triggering command: /home/REDACTED/work/httpr/httpr/.venv/bin/pytest pytest tests/unit/ -x -v ie/list /home/REDACTED/.rustup/toolchains/stable-x86_64-REDACTED-linux-gnu/lib/rustlib/x86_-ldl /home/REDACTED/.rustup/toolchains/stable-x86_64-REDACTED-linux-gnu/lib/rustlib/x86_-lc /home/REDACTED/.rustup/toolchains/stable-x86_64-REDACTED-linux-gnu/lib/rustlib/x86_-L yo3_macros.d404cab788cf4ffa-cgu.0.rcgu.o yo3_macros.d404cab788cf4ffa-cgu.1.rcgu.o yo3_macros.d404cab788cf4ffa-cgu.2.rcgu.o yo3_macros.d404cab788cf4ffa-cgu.3.rcgu.o yo3_macros.d404cab788cf4ffa-cgu.4.rcgu.o yo3_macros.d404cab788cf4ffa-cgu.5.rcgu.o yo3_macros.d404cab788cf4ffa-cgu.6.rcgu.o yo3_macros.d404cab788cf4ffa-cgu.7.rcgu.o ader y3ohwstp6l8fb1diumkp88bl.rcgu.o (dns block)
  • thishostdoesnotexist12345.invalid
    • Triggering command: /home/REDACTED/work/httpr/httpr/.venv/bin/pytest pytest tests/unit/ -x -v ie/list /home/REDACTED/.rustup/toolchains/stable-x86_64-REDACTED-linux-gnu/lib/rustlib/x86_-ldl /home/REDACTED/.rustup/toolchains/stable-x86_64-REDACTED-linux-gnu/lib/rustlib/x86_-lc /home/REDACTED/.rustup/toolchains/stable-x86_64-REDACTED-linux-gnu/lib/rustlib/x86_-L yo3_macros.d404cab788cf4ffa-cgu.0.rcgu.o yo3_macros.d404cab788cf4ffa-cgu.1.rcgu.o yo3_macros.d404cab788cf4ffa-cgu.2.rcgu.o yo3_macros.d404cab788cf4ffa-cgu.3.rcgu.o yo3_macros.d404cab788cf4ffa-cgu.4.rcgu.o yo3_macros.d404cab788cf4ffa-cgu.5.rcgu.o yo3_macros.d404cab788cf4ffa-cgu.6.rcgu.o yo3_macros.d404cab788cf4ffa-cgu.7.rcgu.o ader y3ohwstp6l8fb1diumkp88bl.rcgu.o (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

- Update quinn-proto 0.11.13 → 0.11.14 (Cargo.lock) - fixes unauthenticated remote DoS via QUIC transport parameter parsing
- Update pillow 12.1.1 → 12.2.0 (uv.lock) - fixes PSD out-of-bounds write and FITS GZIP decompression bomb
- Update cbor2 5.8.0 → 5.9.0 (uv.lock) - fixes DoS via uncontrolled recursion in cbor2.loads

Agent-Logs-Url: https://github.com/thomasht86/httpr/sessions/e8a994aa-523e-45e1-9188-aae64c03820e

Co-authored-by: thomasht86 <24563696+thomasht86@users.noreply.github.com>
Copilot AI changed the title [WIP] Bump dependencies to mitigate vulnerabilities fix: bump dependencies to mitigate high-severity vulnerabilities Apr 14, 2026
Copilot AI requested a review from thomasht86 April 14, 2026 06:33
@thomasht86 thomasht86 marked this pull request as ready for review April 14, 2026 06:38
@thomasht86 thomasht86 merged commit b84a055 into main Apr 14, 2026
18 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bump dependencies to mitigate vulnerabilities

2 participants