Repository navigation
chore(deps): update dependencies to resolve Dependabot security alerts - #27
Merged
Merged
Conversation
Python (uv.lock): - PyJWT 2.13.0 -> 2.15.1, urllib3 2.7.0 -> 2.8.0, tornado 6.5.8 -> 6.6, virtualenv 21.7.7 -> 21.14.12, mcp 1.29.1 -> 1.30.0, jupyterlab -> 4.6.4 - Raise floors: mcp>=1.30 (StreamableHTTP session accumulation fix) and jupyterlab>=4.6.4 (XSS / argument-injection fixes) - Cap duckdb<2: DuckDB 2.0 no longer carries E-string escape semantics across implicit string continuation, which the backtick rewriter mirrors from 1.x UI (pnpm): - next / eslint-config-next 16.3.x -> 16.4.2 - vite 8.3.5 as an explicit devDependency (it was only vitest's peer, so updates never moved it off the vulnerable 8.2.1) - Refresh lockfile: brace-expansion, dompurify, postcss-selector-parser, proxy-addr and source-map-js now on patched versions
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Updates Python and UI dependencies to clear the open Dependabot security alerts: 41 of 42 are fixed. The one left is
braces, which has no patched release (details below).Python (
pyproject.toml/uv.lock)pip installcan't resolve to a vulnerable version:mcp>=1.30,<2(extra + dev group) andjupyterlab>=4.6.4,<5.duckdb<2. No alert needs DuckDB 2.0, but the Docker image installs frompyproject.toml, so it was already picking up 2.0.0. DuckDB 2.0 no longer carries E-string escape semantics across implicit string continuation:SELECT E'it'\n'\'s'is now a parse error. That broke threetest_backtick_identifier_translationcases, and those cases also describe what the backtick rewriter inservices/sql_statements.pyexpects. Moving to DuckDB 2 should be its own change, together with the tokenizer update.uv lock --upgrade).UI (
ui/package.json/ui/pnpm-lock.yaml)eslint-config-nextwas bumped to 16.4.2 so it matchesnext.viteis now an explicit devDependency. Until now it came in only as vitest's peer dependency, sopnpm update(and even apnpm.overridesentry) left it on the vulnerable 8.2.1.Not fixed
braces≤ 3.0.3. No patched version exists; 3.0.3 is the latest release. It comes in only throughmicromatch→fast-glob, used by theshadcnCLI and@next/eslint-plugin-next. Both are build-time tools, andbracesis not part of the static UI export that minilake serves. Suggest dismissing the alert as "no fix available / not reachable at runtime" until upstream ships a fix.Test plan
docker compose -f docker-compose.test.yml buildandup --exit-code-from test-runner: 406 passeduv run ruff format --checkanduv run ruff check: cleanpnpm typecheck,pnpm test(32 passed),pnpm build: OKpnpm lint: 0 errors, 1 warning (react-hooks/incompatible-libraryinresults-grid.tsx, already onmain)