Skip to content

fix: resolve Dependabot security vulnerabilities - #239

Merged
mplatzer merged 2 commits into
mainfrom
fix/security-vulnerabilities
Sep 1, 2026
Merged

fix: resolve Dependabot security vulnerabilities#239
mplatzer merged 2 commits into
mainfrom
fix/security-vulnerabilities

Conversation

@mplatzer

@mplatzer mplatzer commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

Summary of Changes

  • Upgraded dependencies in uv.lock to resolve 31 GitHub Dependabot security vulnerability alerts across 9 packages:
    • pillow (12.2.0 -> 12.3.0)
    • cryptography (47.0.0 -> 50.0.1)
    • torch (2.11.0 -> 2.13.0)
    • tornado (6.5.5 -> 6.5.8)
    • urllib3 (2.6.3 -> 2.7.0)
    • pymdown-extensions (10.21.2 -> 11.0.2)
    • soupsieve (2.8.3 -> 2.9.2)
    • setuptools (81.0.0 -> 84.0.0)
    • idna (3.13 -> 3.19)
  • In mostlyai/qa/_accuracy.py, added safe overflow handling (OverflowError, pd.errors.OutOfBoundsDatetime) during datetime bin adjustment on maximum timestamp bounds (pd.Timestamp.max).
  • In README.md, updated the Linux CPU install command with torch==2.13.0+cpu and torchvision==0.28.0+cpu.

Verification

  • pre-commit run --all-files passed.
  • Unit tests (pytest tests/unit) passed.

@mplatzer
mplatzer merged commit 7bc92fd into main Sep 1, 2026
4 checks passed
@mplatzer
mplatzer deleted the fix/security-vulnerabilities branch September 1, 2026 10:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant