Skip to content

security: resolve 37 dependabot vulnerabilities#303

Merged
lgcorzo merged 3 commits into
mainfrom
fix/security-remediation
Apr 12, 2026
Merged

security: resolve 37 dependabot vulnerabilities#303
lgcorzo merged 3 commits into
mainfrom
fix/security-remediation

Conversation

@lgcorzo
Copy link
Copy Markdown
Owner

@lgcorzo lgcorzo commented Apr 12, 2026

This PR resolves 37 security vulnerabilities by upgrading core dependencies.

Key Changes:

  • MLflow: Corrected version from ^3.10.1 (typo) to stable ^2.22.4 to patch security holes.
  • FastAPI/Starlette: Upgraded to latest secure versions.
  • Scikit-learn: Updated from 1.4.2 to ^1.5.0.
  • Transitive Dependencies: Updated h11, waitress, requests, and urllib3 via poetry update.
  • Regenerated lock and requirements: Synchronized all dependency files.

Verified stability via pytest.

@lgcorzo lgcorzo merged commit f7f869d into main Apr 12, 2026
4 checks passed
@lgcorzo lgcorzo deleted the fix/security-remediation branch April 12, 2026 12:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant