Skip to content

chore(deps): move the CI Python tools off a vulnerable starlette #14

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kkdev92 merged 1 commit into from
Sep 21, 2026
+212 −185
Merged

chore(deps): move the CI Python tools off a vulnerable starlette #14

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/scorecard.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,6 @@ jobs:
publish_results: true

- name: Upload to code scanning
uses: github/codeql-action/upload-sarif@18420e3271f74589575af831a523c833acda327f # codeql-bundle-v2.26.2
uses: github/codeql-action/upload-sarif@c23de5a82f64bb08c6d9f28844551440ca298e76 # v4.38.1
with:
sarif_file: results.sarif
27 changes: 6 additions & 21 deletions tools/requirements-ci.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,26 +12,11 @@
# --require-hashes. Resolving this on Windows with Python 3.13 omits
# typing-extensions, which anyio needs on 3.12 and CI would then refuse to
# install. Those two flags are the difference; they are not decoration.
#
# Add --upgrade when the point of the change is to move the transitive closure.
# Without it uv keeps whatever the existing output file already pins, so a bump
# to a direct requirement lands while everything underneath it stays where it
# was -- which looks like a successful regenerate and is not one.

platformio==6.1.19
platformio==6.2.0
gcovr==8.6

# Known advisories in the resolved set, and why they are still here.
#
# starlette is pulled in by PlatformIO and currently resolves to 0.52.1, which
# carries five published advisories: PYSEC-2026-161, -248, -249, -2280 and
# -2281. All five are flaws in serving HTTP -- Host header validation, request
# path handling, StaticFiles traversal, and form field limits -- and all are
# fixed in starlette 1.3.1 or earlier.
#
# They are not reachable here. PlatformIO lists starlette under "PIO Home
# requirements" and imports it only in platformio/home/run.py, the local web UI
# behind `pio home`. CI runs pio test, pio run and pio check, none of which
# start that server; the one other reference, in platformio/compat.py, is a
# threadpool shim on the Python < 3.9 branch that 3.12 never takes.
#
# There is no version to move to. PlatformIO 6.1.19 is the current release and
# requires starlette >=0.19,<0.53, so every fixed version is outside the range
# it will accept. The advisories are left visible in code scanning rather than
# dismissed, and close on their own once PlatformIO widens that constraint and
# this lock is regenerated.
Loading
Loading