Skip to content

v0.16.5: Security fixes #370

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rogermt merged 5 commits into from
Mar 24, 2026
Merged

v0.16.5: Security fixes #370

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
42c76df
fix: Update flatted to fix high severity vulnerability (GHSA-25h7-pfq…
Mar 24, 2026
461a359
fix: Upgrade black to 26.3.1 to fix Dependabot security alerts
Mar 24, 2026
37f9b09
fix: Upgrade pyasn1 to 0.6.3 to fix DoS vulnerability (Dependabot)
Mar 24, 2026
27e06db
fix: Align black version to 26.3.1 across all tooling
Mar 24, 2026
77bb39e
style: Reformat with black 26.3.1
Mar 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion server/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@ dependencies = [
"opencv-python-headless>=4.8.0",
"pyyaml>=6.0",
"boto3>=1.42.60",
"pyasn1>=0.6.3", # Fix DoS vulnerability (Dependabot)
]

[dependency-groups]
Expand All @@ -39,7 +40,7 @@ dev = [
"pytest-cov>=4.0",
"pytest-asyncio>=0.20.0",
"moto>=5.1.21",
"black==24.1.1",
"black>=26.3.1",
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot Mar 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify Black version consistency across config files.
rg -n 'black|rev:' server/pyproject.toml .pre-commit-config.yaml -C2

Repository: rogermt/forgesyte

Length of output: 1271

🏁 Script executed:

rg -i 'black' --type-list | head -5

Repository: rogermt/forgesyte

Length of output: 450

🏁 Script executed:

fd -type f \( -name "requirements*.txt" -o -name "setup.py" -o -name "setup.cfg" -o -name "poetry.lock" \)

Repository: rogermt/forgesyte

Length of output: 231

🏁 Script executed:

rg -n 'black' --type py | head -20

Repository: rogermt/forgesyte

Length of output: 1292

🏁 Script executed:

fd -name "requirements*.txt" -o -name "setup.py" -o -name "setup.cfg" -o -name "pyproject.toml"

Repository: rogermt/forgesyte

Length of output: 291

🏁 Script executed:

rg -n 'black.*=' --type yaml --type toml

Repository: rogermt/forgesyte

Length of output: 106

🏁 Script executed:

find . -name "requirements*.txt" -o -name "setup.py" -o -name "setup.cfg"

Repository: rogermt/forgesyte

Length of output: 84

🏁 Script executed:

cat -n .pre-commit-config.yaml | head -20

Repository: rogermt/forgesyte

Length of output: 731

🏁 Script executed:

cat requirements-lint.txt

Repository: rogermt/forgesyte

Length of output: 197

Align Black version across all tooling to prevent formatter drift.

Black versions are currently inconsistent:

  • requirements-lint.txt: black==24.1.1
  • .pre-commit-config.yaml: rev: 24.1.1
  • server/pyproject.toml (line 43): black>=26.3.1

Developers running uv sync locally will use Black 26.3.1 or later, but pre-commit hooks run 24.1.1, causing formatter conflicts and CI churn.

Update all three files to use Black 26.3.1:

Changes required 
--- a/requirements-lint.txt
+++ b/requirements-lint.txt
@@ -1 +1 @@
-black==24.1.1
+black==26.3.1

--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1 +1 @@
-    rev: 24.1.1
+    rev: 26.3.1

--- a/server/pyproject.toml
+++ b/server/pyproject.toml
@@ -1 +1 @@
-    "black>=26.3.1",
+    "black==26.3.1",
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
"black>=26.3.1",
"black==26.3.1",
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@server/pyproject.toml` at line 43, Update the Black version everywhere so
tooling is consistent: replace any occurrences of "black==24.1.1" and "rev:
24.1.1" with Black 26.3.1 and ensure the line that currently reads
"black>=26.3.1" is normalized to the exact pinned version "black==26.3.1" (so
pre-commit, lint requirements, and pyproject use the same version); search for
those exact strings to locate the entries to change and commit the synchronized
version.

"ruff==0.9.1",
"mypy==1.14.0",
"isort>=5.0.0",
Expand Down
Loading
Loading