fix: address nspect vulnerability report for requests and cryptography#475
Conversation
Bump requests lower bound to >=2.33 to exclude vulnerable 2.32.x and update lockfile to pull cryptography 46.0.6 and requests 2.33.0.
Greptile SummaryThis PR addresses two security vulnerabilities reported by nspect: it raises the
|
| Filename | Overview |
|---|---|
| packages/data-designer-config/pyproject.toml | Bumps requests lower bound to >=2.33 (security fix) and pygments lower bound to >=2.20 (undocumented in PR description but lockfile is consistent). |
| packages/data-designer-engine/pyproject.toml | Removes now-obsolete RequestsDependencyWarning note from chardet pin comment; no functional dependency changes. |
| uv.lock | Updates cryptography 46.0.5 → 46.0.6 and requests 2.32.x → 2.33.0, consistent with pyproject.toml constraints; all hashes regenerated correctly. |
Prompt To Fix All With AI
This is a comment left during a code review.
Path: packages/data-designer-config/pyproject.toml
Line: 28
Comment:
**Undocumented `pygments` version bump**
The lower bound for `pygments` was silently raised from `>=2.19.2` to `>=2.20` — this change is not mentioned in the PR description or title. The lockfile correctly reflects `pygments 2.20.0`, so there's no consistency issue, but it's worth documenting the intent. Was this bump intentional (e.g., a vulnerability fix or required feature)? If so, please add it to the PR summary so reviewers and changelog readers have the full picture.
How can I resolve this? If you propose a fix, please make it concise.Reviews (2): Last reviewed commit: "fix: bump pygments lower bound to >=2.20..." | Re-trigger Greptile
ReDoS vulnerability in the Archetype lexer fixed in Pygments 2.20.0.
Summary
requestslower bound from>=2.32to>=2.33to exclude vulnerable 2.32.x versionscryptography46.0.6 (transitive dep, lockfile-only fix)requests<2.33warning comment in engine pyproject.toml