Skip to content

build(deps): bump the python-minor-patch group across 1 directory with 7 updates - #130

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-patch-e4753d61b9
Closed

build(deps): bump the python-minor-patch group across 1 directory with 7 updates#130
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-patch-e4753d61b9

build(deps): bump the python-minor-patch group across 1 directory wit…

92a97de
Select commit
Loading
Failed to load commit list.
GitHub Advanced Security / Trivy failed Oct 26, 2026 in 4s

67 new alerts including 5 critical severity security vulnerabilities

New alerts in code changed by this pull request

Security Alerts:

  • 5 critical
  • 36 high
  • 21 medium
  • 5 low

Alerts not introduced by this pull request might have been detected because the code changes were too large.

See annotations below for details.

View all branch alerts.

Annotations

Check failure on line 1 in uv.lock

See this annotation in the file changed.

Code scanning / Trivy

filelock: filelock: Arbitrary file overwrite via insecure database file reopening High

Package: filelock
Installed Version: 3.29.1
Vulnerability CVE-2026-112940
Severity: HIGH
Fixed Version: 4.2.1
Link: CVE-2026-112940

Check failure on line 1 in uv.lock

See this annotation in the file changed.

Code scanning / Trivy

pillow: pillow: Information disclosure via uninitialized buffer in TIFF decoding High

Package: pillow
Installed Version: 12.3.0
Vulnerability CVE-2026-112897
Severity: HIGH
Fixed Version: 13.0.0
Link: CVE-2026-112897

Check failure on line 1 in uv.lock

See this annotation in the file changed.

Code scanning / Trivy

Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags High

Package: pillow
Installed Version: 12.3.0
Vulnerability CVE-2026-112902
Severity: HIGH
Fixed Version: 13.0.0
Link: CVE-2026-112902

Check failure on line 1 in uv.lock

See this annotation in the file changed.

Code scanning / Trivy

pillow: pillow: Denial of Service via decompression bomb bypass in SPIDER images High

Package: pillow
Installed Version: 12.3.0
Vulnerability CVE-2026-96637
Severity: HIGH
Fixed Version: 13.0.0
Link: CVE-2026-96637

Check failure on line 1 in uv.lock

See this annotation in the file changed.

Code scanning / Trivy

pillow: pillow: Denial of Service via duplicate page references in PDF files High

Package: pillow
Installed Version: 12.3.0
Vulnerability CVE-2026-96640
Severity: HIGH
Fixed Version: 13.0.0
Link: CVE-2026-96640

Check failure on line 1 in uv.lock

See this annotation in the file changed.

Code scanning / Trivy

pillow: Pillow: Denial of Service via negative archive member size in TarIO High

Package: pillow
Installed Version: 12.3.0
Vulnerability CVE-2026-96642
Severity: HIGH
Fixed Version: 13.0.0
Link: CVE-2026-96642

Check failure on line 1 in uv.lock

See this annotation in the file changed.

Code scanning / Trivy

pillow: pillow: Denial of Service via repeated EXIF headers High

Package: pillow
Installed Version: 12.3.0
Vulnerability CVE-2026-96643
Severity: HIGH
Fixed Version: 13.0.0
Link: CVE-2026-96643

Check failure on line 1 in uv.lock

See this annotation in the file changed.

Code scanning / Trivy

pillow: Pillow: Denial of Service via out-of-bounds read in metafile parser High

Package: pillow
Installed Version: 12.3.0
Vulnerability CVE-2026-96644
Severity: HIGH
Fixed Version: 13.0.0
Link: CVE-2026-96644

Check failure on line 1 in uv.lock

See this annotation in the file changed.

Code scanning / Trivy

pillow: pillow: Arbitrary code execution via JPEG encoder buffer overflow High

Package: pillow
Installed Version: 12.3.0
Vulnerability CVE-2026-96778
Severity: HIGH
Fixed Version: 13.0.0
Link: CVE-2026-96778

Check failure on line 1 in uv.lock

See this annotation in the file changed.

Code scanning / Trivy

Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load() High

Package: pillow
Installed Version: 12.3.0
Vulnerability GHSA-78g4-xqwv-q3g8
Severity: HIGH
Fixed Version: 13.0.0
Link: GHSA-78g4-xqwv-q3g8

Check failure on line 1 in uv.lock

See this annotation in the file changed.

Code scanning / Trivy

virtualenv: virtualenv: Arbitrary command execution via sequential placeholder substitution in activation templates High

Package: virtualenv
Installed Version: 21.4.2
Vulnerability CVE-2026-113776
Severity: HIGH
Fixed Version: 21.14.2
Link: CVE-2026-113776

Check failure on line 1 in uv.lock

See this annotation in the file changed.

Code scanning / Trivy

virtualenv: virtualenv: Arbitrary code execution via improperly quoted Fish activation scripts High

Package: virtualenv
Installed Version: 21.4.2
Vulnerability CVE-2026-113732
Severity: HIGH
Fixed Version: 21.14.2
Link: CVE-2026-113732

Check failure on line 1 in uv.lock

See this annotation in the file changed.

Code scanning / Trivy

virtualenv: virtualenv: Arbitrary command execution via unescaped prompt variables in zsh High

Package: virtualenv
Installed Version: 21.4.2
Vulnerability CVE-2026-113726
Severity: HIGH
Fixed Version: 21.14.4
Link: CVE-2026-113726

Check failure on line 1 in uv.lock

See this annotation in the file changed.

Code scanning / Trivy

virtualenv: virtualenv: arbitrary code execution via crafted environment name High

Package: virtualenv
Installed Version: 21.4.2
Vulnerability CVE-2026-113725
Severity: HIGH
Fixed Version: 21.14.7
Link: CVE-2026-113725

Check failure on line 1 in uv.lock

See this annotation in the file changed.

Code scanning / Trivy

virtualenv: virtualenv: Arbitrary code execution via malicious prompt text High

Package: virtualenv
Installed Version: 21.4.2
Vulnerability CVE-2026-113723
Severity: HIGH
Fixed Version: 21.14.9
Link: CVE-2026-113723

Check failure on line 1 in uv.lock

See this annotation in the file changed.

Code scanning / Trivy

virtualenv: virtualenv: arbitrary code execution via improperly quoted interpreter paths in script launchers High

Package: virtualenv
Installed Version: 21.4.2
Vulnerability CVE-2026-113722
Severity: HIGH
Fixed Version: 21.14.9
Link: CVE-2026-113722

Check failure on line 1 in uv.lock

See this annotation in the file changed.

Code scanning / Trivy

virtualenv: virtualenv: arbitrary code execution via improper quoting in xonsh activation scripts High

Package: virtualenv
Installed Version: 21.4.2
Vulnerability CVE-2026-113718
Severity: HIGH
Fixed Version: 21.14.9
Link: CVE-2026-113718

Check failure on line 1 in uv.lock

See this annotation in the file changed.

Code scanning / Trivy

virtualenv: virtualenv: Arbitrary code execution via unescaped prompt in Windows activation script High

Package: virtualenv
Installed Version: 21.4.2
Vulnerability CVE-2026-102937
Severity: HIGH
Fixed Version: 21.7.12
Link: CVE-2026-102937

Check failure on line 1 in uv.lock

See this annotation in the file changed.

Code scanning / Trivy

urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override High

Package: urllib3
Installed Version: 2.7.0
Vulnerability CVE-2026-97687
Severity: HIGH
Fixed Version: 2.8.0
Link: CVE-2026-97687

Check failure on line 1 in uv.lock

See this annotation in the file changed.

Code scanning / Trivy

urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser High

Package: urllib3
Installed Version: 2.7.0
Vulnerability CVE-2026-97689
Severity: HIGH
Fixed Version: 2.8.0
Link: CVE-2026-97689

Check failure on line 1 in uv.lock

See this annotation in the file changed.

Code scanning / Trivy

virtualenv: virtualenv: Arbitrary code execution via unverified downloaded seed wheels High

Package: virtualenv
Installed Version: 21.4.2
Vulnerability CVE-2026-102930
Severity: HIGH
Fixed Version: 21.7.12
Link: CVE-2026-102930

Check failure on line 1 in uv.lock

See this annotation in the file changed.

Code scanning / Trivy

virtualenv: virtualenv: Arbitrary code execution via crafted paths in activation scripts High

Package: virtualenv
Installed Version: 21.4.2
Vulnerability CVE-2026-102925
Severity: HIGH
Fixed Version: 21.7.13
Link: CVE-2026-102925

Check failure on line 1 in uv.lock

See this annotation in the file changed.

Code scanning / Trivy

pillow: Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO Critical

Package: pillow
Installed Version: 12.3.0
Vulnerability CVE-2026-112393
Severity: CRITICAL
Fixed Version: 13.0.0
Link: CVE-2026-112393

Check failure on line 1 in uv.lock

See this annotation in the file changed.

Code scanning / Trivy

pillow: Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution Critical

Package: pillow
Installed Version: 12.3.0
Vulnerability CVE-2026-112398
Severity: CRITICAL
Fixed Version: 13.0.0
Link: CVE-2026-112398

Check failure on line 1 in uv.lock

See this annotation in the file changed.

Code scanning / Trivy

pillow: Pillow: Heap buffer overflow in ImagingJpegDecode Critical

Package: pillow
Installed Version: 12.3.0
Vulnerability CVE-2026-112403
Severity: CRITICAL
Fixed Version: 13.0.0
Link: CVE-2026-112403