From 422f6fc683d0fda50454b870bad08ca0502601f4 Mon Sep 17 00:00:00 2001 From: "pre-commit-ci[bot]" <66853113+pre-commit-ci[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 20:00:02 +0000 Subject: [PATCH 1/2] [pre-commit.ci] pre-commit autoupdate MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit updates: - [github.com/astral-sh/ruff-pre-commit: v0.16.3 → v0.16.4](https://github.com/astral-sh/ruff-pre-commit/compare/v0.16.3...v0.16.4) --- .pre-commit-config.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 164b97e..9f4c283 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -25,7 +25,7 @@ repos: - id: uv-lock - repo: https://github.com/astral-sh/ruff-pre-commit - rev: v0.16.3 + rev: v0.16.4 hooks: - id: ruff-check args: [--fix, --exit-non-zero-on-fix] From 3afb49ae4dfd304d03a25678e55693fbc1e4e3fa Mon Sep 17 00:00:00 2001 From: "aieng-bot[bot]" Date: Mon, 31 Aug 2026 15:52:48 +0000 Subject: [PATCH 2/2] chore: bump datasets to 5.0.1 and pip to 26.2 to fix PYSEC-2026-3716 and PYSEC-2026-3721 - datasets>=5.0.1: path traversal vulnerability in folder-based dataset builders (PYSEC-2026-3716) - pip>=26.2: doubly-encoded package URL path traversal allowing files to be written to arbitrary locations (PYSEC-2026-3721) Co-authored-by: aieng-bot --- pyproject.toml | 4 ++-- uv.lock | 16 ++++++++-------- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index a2bc981..c242766 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -10,7 +10,7 @@ dependencies = [ "aieng-eval-agents>=0.1.0", "aiohttp>=3.14.3", # CVE-2026-34513/34514/34515/34516/34517/34518/34519/34520/34525, CVE-2026-22815: multiple DoS/security fixes in 3.13.4; CVE-2026-54273/54274/54275/54276/54277/54278/54279/54280: multiple DoS/security fixes in 3.14.1; CVE-2026-69244: heap read OOB in C response parser fixed in 3.14.3 "beautifulsoup4>=4.13.4", - "datasets>=3.6.0", + "datasets>=5.0.1", # PYSEC-2026-3716: path traversal vulnerability in folder-based dataset builders fixed in 5.0.1 "e2b-code-interpreter>=2.4.1", "langfuse>=3.10.3,<4.0.0", "lxml>=6.0.0", @@ -53,7 +53,7 @@ dev = [ "jupyter>=1.1.1", "jupyterlab>=4.6.2", # CVE-2026-42266/42557: extension allow-list bypass and command linker XSS fixed in 4.5.7; GHSA-vmhf-c436-hxj4: javascript: URL XSS in Extension Manager fixed in 4.5.9; GHSA-h5v5-8746-g7mm/GHSA-whvh-wf3x-g77j/GHSA-gx64-gj6p-pc4c/GHSA-pppj-hq3g-57pj/GHSA-89vp-jrxv-24w8: plugin manager bypass/XSS/settings code injection fixed in 4.6.2 "nbqa>=1.9.1", - "pip>=26.1.2", # Pinning version to address vulnerability GHSA-6vgw-5pg2-w6jp, CVE-2026-3219; PYSEC-2026-196: entry point path traversal fixed in 26.1.2 + "pip>=26.2", # Pinning version to address vulnerability GHSA-6vgw-5pg2-w6jp, CVE-2026-3219; PYSEC-2026-196: entry point path traversal fixed in 26.1.2; PYSEC-2026-3721: doubly-encoded package URL path traversal fixed in 26.2 "pip-audit>=2.9.0", "pre-commit>=4.2.0", "pytest>=9.0.3", # CVE-2025-71176: tmp dir privilege escalation fixed in 9.0.3 diff --git a/uv.lock b/uv.lock index 25e631b..df94a40 100644 --- a/uv.lock +++ b/uv.lock @@ -116,7 +116,7 @@ requires-dist = [ { name = "beautifulsoup4", specifier = ">=4.13.4" }, { name = "certifi", specifier = ">=2026.1.4" }, { name = "cryptography", specifier = ">=50.0.0" }, - { name = "datasets", specifier = ">=3.6.0" }, + { name = "datasets", specifier = ">=5.0.1" }, { name = "e2b-code-interpreter", specifier = ">=2.4.1" }, { name = "filelock", specifier = ">=3.20.3" }, { name = "google-generativeai", specifier = ">=0.8.6" }, @@ -157,7 +157,7 @@ dev = [ { name = "mypy", specifier = ">=1.19.0" }, { name = "nbqa", specifier = ">=1.9.1" }, { name = "pandas-stubs", specifier = ">=2.3.3.260113" }, - { name = "pip", specifier = ">=26.1.2" }, + { name = "pip", specifier = ">=26.2" }, { name = "pip-audit", specifier = ">=2.9.0" }, { name = "pre-commit", specifier = ">=4.2.0" }, { name = "pytest", specifier = ">=9.0.3" }, @@ -1206,7 +1206,7 @@ wheels = [ [[package]] name = "datasets" -version = "4.8.5" +version = "5.0.1" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "dill" }, @@ -1224,9 +1224,9 @@ dependencies = [ { name = "tqdm" }, { name = "xxhash" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/66/34/14cd8e76f907f7d4dca2334cfeec9f81d30fd15c25a015f99aaea694eaed/datasets-4.8.5.tar.gz", hash = "sha256:0f0c1c3d56ffff2c93b2f4c63c95bac94f3d7e8621aea2a2a576275233bba772", size = 605649, upload-time = "2026-04-27T15:43:57.384Z" } +sdist = { url = "https://files.pythonhosted.org/packages/0a/5b/836516269d4f618efe621661cfb6f9acc57e6f95265db3efaee48a5ffe04/datasets-5.0.1.tar.gz", hash = "sha256:ce22bb851efd7494f08aad33b940803784434f6e77763d00679a0dc45fcf686a", size = 641498, upload-time = "2026-07-28T11:09:12.016Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/65/99/00f3196036501b53032c4b1ab8337a0b978dee832ed276dae3815df4e8b5/datasets-4.8.5-py3-none-any.whl", hash = "sha256:5079900781719c0e063a8efdd2cd95a31ad0c63209178669cd23cf1b926149ff", size = 528973, upload-time = "2026-04-27T15:43:53.702Z" }, + { url = "https://files.pythonhosted.org/packages/44/0b/98fc6eb83333508ca5f44c52b3e287ea8137a0ad582714e2cbc67a02154b/datasets-5.0.1-py3-none-any.whl", hash = "sha256:9fbf73688f8c18f7529b4fe592abd04015f81d1e58001e4bac73ffb2b39d7cc4", size = 559079, upload-time = "2026-07-28T11:09:10.266Z" }, ] [[package]] @@ -4530,11 +4530,11 @@ wheels = [ [[package]] name = "pip" -version = "26.1.2" +version = "26.2.1" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/01/91/47e7d486260f618783899587af63ccf7980fb60245c3e63dd4571c6b57ad/pip-26.1.2.tar.gz", hash = "sha256:f49cd134c61cf2fd75e0ce2676db03e4054504a5a4986d00f8299ae632dc4605", size = 1840799, upload-time = "2026-05-31T17:33:58.56Z" } +sdist = { url = "https://files.pythonhosted.org/packages/ae/15/4500e320e6b101ec3b719ae85b697d9940b6cda672bc555bd6016fc60c6f/pip-26.2.1.tar.gz", hash = "sha256:f6ad667e89a1fe78046c8f13232b247200f5258d7828f3f7883d660878e0813f", size = 1848877, upload-time = "2026-08-04T22:51:14.148Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/5d/95/6b5cb3461ea5673ba0995989746db58eb18b91b54dbf331e72f569540946/pip-26.1.2-py3-none-any.whl", hash = "sha256:382ff9f685ee3bc25864f820aa50505825f10f5458ffff07e30a6d96e5715cab", size = 1813144, upload-time = "2026-05-31T17:33:56.772Z" }, + { url = "https://files.pythonhosted.org/packages/f3/6e/1736e5b4ae2b778ef2f81c47d797de9f891d4d8acb047a24ca37a60294dd/pip-26.2.1-py3-none-any.whl", hash = "sha256:71138adf1f4ca900cdb7d289c21b7494329f2332b6d85f0e1c42108c0384ed3e", size = 1816632, upload-time = "2026-08-04T22:51:12.472Z" }, ] [[package]]