External/roboco
1
0
Fork 0
mirror of https://github.com/rennf93/roboco.git synced 2026-08-03 07:23:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

build(deps): raise pyjwt floor to >=2.13.0 and format bump_version

Browse Source 
pyjwt 2.12.1 (pulled transitively by mcp and msal) carries four disclosed CVEs fixed in 2.13.0; add a uv constraint-dependencies floor and refresh the lock. Also apply ruff formatting to the changelog scaffold f-string in the version-bump script.
This commit is contained in:
Renn F
2026-06-03 20:45:32 +02:00
parent 49fddd1dc1
commit a14e870ebb
3 changed files with 16 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pyproject.toml
+9
View File
@@ -131,6 +131,15 @@ explicit = true
[tool.uv.sources]
torch = [{ index = "pytorch-cpu" }]
# =============================================================================
# uv: raise the floor on vulnerable transitive dependencies
# =============================================================================
# pyjwt is pulled in transitively (by mcp and msal). 2.12.1 carries four
# disclosed CVEs that are fixed in 2.13.0; constrain the floor so the resolver
# picks a patched release while leaving the direct dependents' own ranges intact.
[tool.uv]
constraint-dependencies = ["pyjwt>=2.13.0"]
# =============================================================================
# RUFF Configuration
# =============================================================================