chore: bump astral-sh/setup-uv from 8.1.0 to 8.2.0#109
Conversation
dependabot
Bot
added
dependencies
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerabilities reported by pip-audit, but cannot fix them automatically because no patched version has been released to PyPI yet:
Why this cannot be auto-fixedThe vulnerability exists in The vulnerability is: a pre-authentication code injection flaw allowing an unauthenticated attacker to run arbitrary code on the server when What was auto-fixed in this PR
Recommended next steps
This PR will not be auto-merged until the chromadb vulnerability is resolved. |
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerability reported by pip-audit, but cannot fix it automatically because no patched version has been released to PyPI yet:
Why this cannot be auto-fixedThe vulnerability exists in CVE details: A pre-authentication, code injection vulnerability in ChromaDB ≥ 1.0.0 allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository with Recommended next steps
This PR will not be auto-merged until the vulnerability is resolved. |
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerability reported by pip-audit, but cannot fix it automatically because no patched version has been released to PyPI yet:
Why this cannot be auto-fixedThe vulnerability exists in aieng-bot verified that upgrading to the latest available version ( Recommended next steps
This PR will not be auto-merged until the vulnerability is resolved. |
amrit110
force-pushed
the
dependabot/github_actions/astral-sh/setup-uv-8.2.0
branch
from
089cf6d to
14ba27d
Compare
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerability reported by pip-audit, but cannot fix it automatically because no patched version has been released to PyPI yet:
Why this cannot be auto-fixedThe vulnerability exists in Vulnerability details
Recommended next steps
This PR will not be auto-merged until the vulnerability is resolved or explicitly acknowledged by a human reviewer. |
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerability reported by pip-audit, but cannot fix it automatically because no patched version has been released to PyPI yet:
Vulnerability DetailsCVE-2026-45829: A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and Why this cannot be auto-fixedThe OSV advisory (GHSA-f4j7-r4q5-qw2c) shows Recommended next steps
This PR will not be auto-merged until the vulnerability is resolved. |
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerability reported by pip-audit, but cannot fix it automatically because no patched version has been released to PyPI yet:
Why this cannot be auto-fixedThe vulnerability exists in Vulnerability summary: A pre-authentication, code injection vulnerability allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository with Recommended next steps
This PR will not be auto-merged until the vulnerability is resolved. |
Security Vulnerabilities — Partial Fix Appliedaieng-bot applied a partial fix and found the following remaining security vulnerabilities reported by pip-audit that cannot be fixed automatically: Fixed ✅
No Fix Available ❌
Cannot Fix Due to Dependency Conflicts
|
| Package | Version | Vulnerability | Fix Version | Blocker |
|---|---|---|---|---|
| langchain-openai | 0.3.35 | PYSEC-2026-76 | 1.1.14 | v1.1.14 requires pypdf<5.1.0, incompatible with project's pypdf>=6.x requirement |
| langchain-text-splitters | 0.3.11 | PYSEC-2026-77 | 1.1.2 | Transitive dep; same conflict as langchain-openai |
| langgraph | 0.5.0 | PYSEC-2026-83 | 1.0.10 | v1.0.10 requires pypdf<5.1.0, incompatible with project's pypdf>=6.x requirement |
Why this cannot be auto-merged
-
CVE-2026-45829 (chromadb): No patched release exists on PyPI yet. The vulnerability affects all versions from 1.0.0 onwards. A fix requires the upstream ChromaDB maintainers to release a new version.
-
PYSEC-2026-76/77/83 (langchain-openai, langchain-text-splitters, langgraph): The fix versions of these packages require
pypdf<5.1.0, which directly conflicts with the project's explicitpypdf>=6.xdependency. Resolving this would require a larger dependency refactoring that is out of scope for an automated fix.
Recommended next steps
- Monitor the ChromaDB advisory (CVE-2026-45829) for an upstream patch release
- Review the langchain ecosystem upgrade path — langchain-openai 1.x+ and langgraph 1.x+ appear to have dropped pypdf 6.x compatibility; a migration plan may be needed
- Consider whether temporary
ignore-vulnsentries can be added to the CI workflow with documented justification (requires human review)
This PR will not be auto-merged until the vulnerabilities are resolved.
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerability reported by pip-audit, but cannot fix it automatically because no patched version has been released to PyPI yet:
Why this cannot be auto-fixedCVE-2026-45829 is a pre-authentication code injection vulnerability in Recommended next steps
This PR will not be auto-merged until the vulnerability is resolved. |
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerability reported by pip-audit, but cannot fix it automatically because no patched version has been released to PyPI yet:
Vulnerability DetailsA pre-authentication, code injection vulnerability in ChromaDB version 1.0.0 or later allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository with Why this cannot be auto-fixedThe vulnerability exists in Recommended next steps
This PR will not be auto-merged until the vulnerability is resolved. |
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerabilities reported by pip-audit, but cannot fix them automatically because no patched version has been released to PyPI yet:
Why this cannot be auto-fixedThe vulnerability exists in The vulnerability description: A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the Recommended next steps
This PR will not be auto-merged until the vulnerability is resolved. |
|
Automated fix applied and PR merged The agentic fix loop successfully fixed this PR and merged it. ✓ Successfully fixed security failures - Modified 0 files - Executed 73 agent actions - (35 info, 16 tool_call, 3 error, 13 tool_result, 6 reasoning) View detailed trace on dashboard | Raw trace AI Engineering Maintenance Bot |
Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.1.0 to 8.2.0. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@0880764...fac544c) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 8.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
…rabilities - Bump aiohttp>=3.14.0 (fixes CVE-2026-34993, CVE-2026-47265) - Add pip>=26.1.2 to dev deps (fixes PYSEC-2026-196 via pip-api transitive dep) Co-authored-by: aieng-bot <aieng-bot@vectorinstitute.ai>
Co-authored-by: aieng-bot <aieng-bot@vectorinstitute.ai>
amrit110
force-pushed
the
dependabot/github_actions/astral-sh/setup-uv-8.2.0
branch
from
8162363 to
57c8a9d
Compare
Fix GHSA-537c-gmf6-5ccf: bump cryptography to >=48.0.1 (resolved to 49.0.0) Fix GHSA-f4xh-w4cj-qxq8: bump langsmith to >=0.8.18 Fix GHSA-6v7p-g79w-8964: add msgpack>=1.2.1 direct dep Fix GHSA-4xgf-cpjx-pc3j: add pydantic-settings>=2.14.2 direct dep Fix GHSA-jm82-fx9c-mx94: bump pypdf to >=6.13.3 Co-authored-by: aieng-bot <aieng-bot@vectorinstitute.ai>
Security Vulnerabilities — Cannot Auto-Fixaieng-bot found additional security vulnerabilities reported by pip-audit that cannot be fixed automatically because either no patched version is available, or the upgrade path conflicts with other project dependencies. Fixable vulnerabilities addressed in this commit:
Unfixable vulnerabilities — require human review:
Root cause of dep conflictsAll langchain ecosystem packages (langchain, langchain-openai, langchain-text-splitters, langgraph) have fixes available in their 1.x series, but upgrading to 1.x requires: This conflicts with Recommended next steps
This PR will not be auto-merged until the vulnerabilities are resolved. |
|
Automated fix applied and PR merged The agentic fix loop successfully fixed this PR and merged it. ✓ Successfully fixed security failures - Modified 1 files - Executed 612 agent actions - (419 info, 81 tool_call, 13 error, 65 tool_result, 31 reasoning, 3 action) View detailed trace on dashboard | Raw trace AI Engineering Maintenance Bot |
Security Vulnerabilities — No Automatic Fix Availableaieng-bot found the following security vulnerabilities reported by pip-audit, but cannot fix them automatically because no compatible patched version can be resolved in this dependency tree:
Why these cannot be auto-fixedchromadb (CVE-2026-45829): A pre-authentication code injection vulnerability affecting version 1.0.0+. No patched release has been published to PyPI yet. The fix must come from the chromadb upstream maintainers. langchain (GHSA-gr75-jv2w-4656): The fix requires upgrading from Recommended next steps
This PR will not be auto-merged until the vulnerabilities are resolved. Generated by aieng-bot |
|
Automated fix applied and PR merged The agentic fix loop successfully fixed this PR and merged it. ✓ Successfully fixed security failures - Modified 1 files - Executed 181 agent actions - (119 info, 27 tool_call, 2 error, 21 tool_result, 11 reasoning, 1 action) View detailed trace on dashboard | Raw trace AI Engineering Maintenance Bot |
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerabilities reported by pip-audit, but cannot fix them automatically because no compatible patched versions can be applied to this project:
Why these cannot be auto-fixedchromadb CVE-2026-45829: A code injection vulnerability affecting chromadb ≥1.0.0. No patched version has been published to PyPI — 1.5.9 is the latest available release. langchain GHSA-gr75-jv2w-4656: pip-audit reports a fix at version 1.3.9, but that is a major version jump (0.3.x → 1.x). Attempting the upgrade fails dependency resolution because Recommended next steps
This PR will not be auto-merged until the vulnerabilities are resolved. |
|
Automated fix applied and PR merged The agentic fix loop successfully fixed this PR and merged it. ✓ Successfully fixed security failures - Modified 1 files - Executed 321 agent actions - (243 info, 36 tool_call, 5 error, 28 tool_result, 9 reasoning) View detailed trace on dashboard | Raw trace AI Engineering Maintenance Bot |
1 participant
Bumps astral-sh/setup-uv from 8.1.0 to 8.2.0.
Release notes
Sourced from astral-sh/setup-uv's releases.
... (truncated)
Commits
fac544cchore(deps): roll up dependabot updates (#903)7390f77docs: update dependabot rollup biome guidance (#902)363c64achore(deps): roll up dependabot updates (#901)c4fcbafchore(deps): bump release-drafter/release-drafter from 7.3.0 to 7.3.1 (#900)8e642c5chore: update known checksums for 0.11.18 (#899)a92cb43Add quiet input to suppress info-level log output (#898)e07f2acchore(deps): bump eifinger/actionlint-action from 1.10.1 to 1.10.2 (#842)bc4034echore(deps): bump github/codeql-action from 4.35.4 to 4.36.0 (#893)df42d4fchore(deps): bump zizmorcore/zizmor-action from 0.5.5 to 0.5.6 (#891)b9c8c4cfeat: adddownload-from-astral-mirrorinput (#897)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)