FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

chore(security): pin down dependencies and workflow actions by keshav-space · Pull Request #2236 · aboutcode-org/vulnerablecode · GitHub

/ vulnerablecode Public

chore(security): pin down dependencies and workflow actions - #2236

Merged
keshav-space merged 7 commits into
mainfrom
pin-dependencies
Mar 27, 2026
ConversationCommits (7)ChecksFiles changed
Merged

chore(security): pin down dependencies and workflow actions#2236
keshav-space merged 7 commits into
mainfrom
pin-dependencies

Conversation

keshav-space commented Mar 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Member
  • Pin all direct dependencies
  • Pin workflow actions to full commit SHA
  • Set explicit workflow permissions
  • Following vulnerable dependency were bumped:
    • pkg:pypi/black@22.3.0 -> 24.3.0
    • pkg:pypi/cryptography@44.0.1 -> 46.0.5
    • pkg:pypi/idna@3.3 -> 3.7
    • pkg:pypi/redis@5.0.1 -> 6.2.0
    • pkg:pypi/requests@2.32.0 -> 2.32.4
    • pkg:pypi/sqlparse@0.5.0 -> 0.5.4
    • pkg:pypi/starlette@0.47.0 -> 0.49.1
    • pkg:pypi/urllib3@1.26.19 -> 2.6.3

chore(deps): pin dependencies
9b3167c 
Signed-off-by: Keshav Priyadarshi <git@keshav.space>
fix: select next div sibling for fixed version parsing
c87819b 
Signed-off-by: Keshav Priyadarshi <git@keshav.space>
refactor(deps): use separate requirement file for dev dependencies
8e7b3a5 
Signed-off-by: Keshav Priyadarshi <git@keshav.space>
chore(security): pin down actions to commit and set expecit workflow …
d358cd3 
…permissions

Signed-off-by: Keshav Priyadarshi <git@keshav.space>
fix(deps): bump sphinx to v5.0.0
10fdf34 
Signed-off-by: Keshav Priyadarshi <git@keshav.space>
chore(security): bump vulnerable dependencies
78f9d96 
Signed-off-by: Keshav Priyadarshi <git@keshav.space>
style: format code using the latest version of Black
337da63 
Signed-off-by: Keshav Priyadarshi <git@keshav.space>
keshav-space changed the title Pin down dependencies and workflow actions chore(security): pin down dependencies and workflow actions Mar 27, 2026
keshav-space merged commit 0e7adc6 into main Mar 27, 2026
8 checks passed
keshav-space deleted the pin-dependencies branch March 27, 2026 12:29
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

Back | FazBrowse Home | New Git URL