From 46986e664f16eba711341de7dd4d497a9e11ba59 Mon Sep 17 00:00:00 2001 From: Michael D'Angelo Date: Sat, 19 Sep 2026 15:04:13 -0700 Subject: [PATCH 1/2] fix(deps): upgrade GitPython security floor --- CHANGELOG.md | 1 + tests/test_dependency_lock.py | 2 +- uv.lock | 6 +++--- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ac57e303b..33027145b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Upgrade gzip, PCRE2, SQLite, and Perl in Docker runtime images to pick up Debian security fixes. - Upgrade locked GitPython to 3.1.59 to address four dependency audit advisories. +- Upgrade locked GitPython to 3.1.60 to address newly disclosed dependency audit advisories. - Inspect hidden ZIP archives and malicious pickle payloads in legacy GGML model variants. - Stop reporting a ZIP polyglot for GGUF/GGML files whose tensor data merely contains an end-of-central-directory signature. - Upgrade Debian util-linux packages in all Docker runtime images to remediate CVE-2026-53615. diff --git a/tests/test_dependency_lock.py b/tests/test_dependency_lock.py index a06feb7b7..cfb76589e 100644 --- a/tests/test_dependency_lock.py +++ b/tests/test_dependency_lock.py @@ -16,7 +16,7 @@ ROOT_PYPROJECT = ROOT_DIR / "pyproject.toml" RENOVATE_CONFIG = ROOT_DIR / "renovate.json" PICKLESCAN_PYPROJECT = ROOT_DIR / "packages" / "modelaudit-picklescan" / "pyproject.toml" -PATCHED_GITPYTHON_FLOOR = (3, 1, 59) +PATCHED_GITPYTHON_FLOOR = (3, 1, 60) PINNED_MATURIN_BACKEND = "maturin===1.13.3" REQUIRED_PICKLESCAN_RELEASE = "modelaudit-picklescan>=0.1.10,<0.2.0" PATCHED_PY7ZR_REQUIREMENT = "py7zr>=1.1.3" diff --git a/uv.lock b/uv.lock index 7d5651c10..d845d636d 100644 --- a/uv.lock +++ b/uv.lock @@ -1107,14 +1107,14 @@ wheels = [ [[package]] name = "gitpython" -version = "3.1.59" +version = "3.1.60" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "gitdb" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/ca/dc/126b28e76b24a9268ba931ad3e012f71ebdadf62fd9f17758f7074bb0b20/gitpython-3.1.59.tar.gz", hash = "sha256:0a1475cfdc38a5bfba1a3e9a4a9da52a39749ecec322b772915c019f94e5b7e4", size = 230445, upload-time = "2026-08-10T12:03:20.271Z" } +sdist = { url = "https://files.pythonhosted.org/packages/84/14/e6b1a48d831755a53c2029351fcef82e70db4a08f338daefe29d8d0cf31c/gitpython-3.1.60.tar.gz", hash = "sha256:e936431879fa85581b4311fa63492ea52251909e2d655b6529c704c904ddcc24", size = 230793, upload-time = "2026-08-25T18:33:46.102Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/ef/ed/ae57eb7d344f43f87b74b3a281ead6ec7d6394eef72a7b1dcb28dd089550/gitpython-3.1.59-py3-none-any.whl", hash = "sha256:67a82f537384578643624c8b2c531938a9b82be431663e575dcf638526631d4c", size = 220996, upload-time = "2026-08-10T12:03:18.804Z" }, + { url = "https://files.pythonhosted.org/packages/71/63/ba28697918b7c190af9f3f21940d03e8814e25dd4ddd39d6929f3a553995/gitpython-3.1.60-py3-none-any.whl", hash = "sha256:39548bffb8fa0f3a548133348868bb4838e79d73283052207dc97781a569b6b4", size = 221893, upload-time = "2026-08-25T18:33:44.75Z" }, ] [[package]] From ac1483f7d231da101a83677bd66eb7932e4aafe8 Mon Sep 17 00:00:00 2001 From: Michael D'Angelo Date: Sun, 20 Sep 2026 15:03:59 -0700 Subject: [PATCH 2/2] fix(deps): upgrade AnyIO security floor --- tests/test_dependency_lock.py | 2 ++ uv.lock | 6 +++--- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/tests/test_dependency_lock.py b/tests/test_dependency_lock.py index cfb76589e..6d4b67365 100644 --- a/tests/test_dependency_lock.py +++ b/tests/test_dependency_lock.py @@ -17,6 +17,7 @@ RENOVATE_CONFIG = ROOT_DIR / "renovate.json" PICKLESCAN_PYPROJECT = ROOT_DIR / "packages" / "modelaudit-picklescan" / "pyproject.toml" PATCHED_GITPYTHON_FLOOR = (3, 1, 60) +PATCHED_ANYIO_FLOOR = (4, 14, 2) PINNED_MATURIN_BACKEND = "maturin===1.13.3" REQUIRED_PICKLESCAN_RELEASE = "modelaudit-picklescan>=0.1.10,<0.2.0" PATCHED_PY7ZR_REQUIREMENT = "py7zr>=1.1.3" @@ -81,6 +82,7 @@ def test_gitpython_lock_stays_on_patched_release_floor() -> None: ("package_name", "patched_floor"), [ ("aiohttp", (3, 14, 3)), + ("anyio", PATCHED_ANYIO_FLOOR), ("cryptography", (50, 0, 0)), ("keras", (3, 15, 0)), ("sqlparse", (0, 6, 0)), diff --git a/uv.lock b/uv.lock index d845d636d..6f4c6b6e6 100644 --- a/uv.lock +++ b/uv.lock @@ -202,16 +202,16 @@ wheels = [ [[package]] name = "anyio" -version = "4.13.0" +version = "4.14.2" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "exceptiongroup", marker = "python_full_version < '3.11'" }, { name = "idna" }, { name = "typing-extensions", marker = "python_full_version < '3.13'" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/19/14/2c5dd9f512b66549ae92767a9c7b330ae88e1932ca57876909410251fe13/anyio-4.13.0.tar.gz", hash = "sha256:334b70e641fd2221c1505b3890c69882fe4a2df910cba14d97019b90b24439dc", size = 231622, upload-time = "2026-03-24T12:59:09.671Z" } +sdist = { url = "https://files.pythonhosted.org/packages/61/cc/a381afa6efea9f496eff839d4a6a1aed3bfafc7b3ab4b0d1b243a12573dd/anyio-4.14.2.tar.gz", hash = "sha256:cfa139f3ed1a23ee8f88a145ddb5ac7605b8bbfd8592baacd7ce3d8bb4313c7f", size = 260176, upload-time = "2026-07-12T20:29:07.082Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/da/42/e921fccf5015463e32a3cf6ee7f980a6ed0f395ceeaa45060b61d86486c2/anyio-4.13.0-py3-none-any.whl", hash = "sha256:08b310f9e24a9594186fd75b4f73f4a4152069e3853f1ed8bfbf58369f4ad708", size = 114353, upload-time = "2026-03-24T12:59:08.246Z" }, + { url = "https://files.pythonhosted.org/packages/da/35/f2287558c17e29fafc8ef3daf819bb9834061cfa43bff8014f7df7f63bdc/anyio-4.14.2-py3-none-any.whl", hash = "sha256:9f505dda5ac9f0c8309b5e8bd445a8c2bf7246f3ce950121e45ea15bc41d1494", size = 125813, upload-time = "2026-07-12T20:29:05.763Z" }, ] [[package]]