From 7130ec8fa0625dc6a38077361cf2151aee48a81e Mon Sep 17 00:00:00 2001 From: Rustam SecondFry Gubaydullin Date: Tue, 27 Oct 2026 18:21:01 +0300 Subject: [PATCH 1/2] Bump setuptools to 84.2.1 to clear GHSA-xmj3-9gf7-h52w Dependabot flagged the locked setuptools 84.0.0 (pulled in by PyInstaller for the dev/build environment) as vulnerable; 84.1.0 is the first fixed release. Only the setuptools entry was swapped in place rather than re-running pipenv lock, so the rest of the build toolchain doesn't drift as a side effect of a low-severity security bump. Co-Authored-By: Claude Opus 5.5 (1M context) --- Pipfile.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Pipfile.lock b/Pipfile.lock index b5b69e4..3f23ade 100644 --- a/Pipfile.lock +++ b/Pipfile.lock @@ -566,11 +566,11 @@ }, "setuptools": { "hashes": [ - "sha256:51a52592b3b99e102b609654876bd65f19f999935166d1352678931132b0c670", - "sha256:f4695c21257f0d9b537ec2692c941d02ee143b7cc1276941349a546573b2ef73" + "sha256:3ff8b3b5492a0aa66960f4419365a86b84e013070d4313e4d4a6894f5d64d6bc", + "sha256:ca140b45d5325a9478f880e351484f62fef15f336462e449ca0c03c873d589c2" ], "markers": "python_version >= '3.10'", - "version": "==84.0.0" + "version": "==84.2.1" }, "tomlkit": { "hashes": [ From d7587aecddbbf0139222a7ed73b44002acf9a4aa Mon Sep 17 00:00:00 2001 From: Rustam SecondFry Gubaydullin Date: Tue, 27 Oct 2026 18:47:45 +0300 Subject: [PATCH 2/2] Bump setuptools in requirements.txt to match Pipfile.lock requirements.txt is a hashed export of the lock, and the previous commit only updated the lock, so anyone installing from requirements.txt would still get the vulnerable setuptools 84.0.0 flagged by GHSA-xmj3-9gf7-h52w. Co-Authored-By: Claude Opus 5.5 (1M context) --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 85e564f..4e10ce2 100644 --- a/requirements.txt +++ b/requirements.txt @@ -19,7 +19,7 @@ pyinstaller-hooks-contrib==2026.8; python_version >= '3.8' --hash=sha256:4d82578 pylint==4.1.2; python_full_version >= '3.10.0' --hash=sha256:235f13dc418c0041c649b42a5c35c99f2ffc6ca8b6a7574958eac5335906a68a --hash=sha256:e34c8636edc7d60a2eaadca4ad6c18a49e202361987a26e81b2a17fa92be28e1 pytest==9.1.1; python_version >= '3.10' --hash=sha256:1088fbde8f2b49d95a549a195707afa7a76a3ce9bcadc26b6d71f0ffda5fe313 --hash=sha256:37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c pywin32-ctypes==0.2.3; sys_platform == 'win32' --hash=sha256:8a1513379d709975552d202d942d9837758905c8d01eb82b8bcc30918929e7b8 --hash=sha256:d162dc04946d704503b2edc4d55f3dba5c1d539ead017afa00142c38b9885755 -setuptools==84.0.0; python_version >= '3.10' --hash=sha256:51a52592b3b99e102b609654876bd65f19f999935166d1352678931132b0c670 --hash=sha256:f4695c21257f0d9b537ec2692c941d02ee143b7cc1276941349a546573b2ef73 +setuptools==84.2.1; python_version >= '3.10' --hash=sha256:3ff8b3b5492a0aa66960f4419365a86b84e013070d4313e4d4a6894f5d64d6bc --hash=sha256:ca140b45d5325a9478f880e351484f62fef15f336462e449ca0c03c873d589c2 tomlkit==0.15.1; python_version >= '3.9' --hash=sha256:177a05aece5a8ca5266fd3c448abb47b8d352f09d477d3ca8332db4d89b24304 --hash=sha256:e25bbf38843005246210a12982776f27f99cb9be67160e14434d0c0d21ee1e97 yapf==0.43.0; python_version >= '3.7' --hash=sha256:00d3aa24bfedff9420b2e0d5d9f5ab6d9d4268e72afbf59bb3fa542781d5218e --hash=sha256:224faffbc39c428cb095818cf6ef5511fdab6f7430a10783fdfb292ccf2852ca appdirs==1.4.4 --hash=sha256:7d5d0167b2b1ba821647616af46a749d1c653740dd0d2415100fe26e27afdf41 --hash=sha256:a841dacd6b99318a741b166adb07e19ee71a274450e68237b4650ca1055ab128