fix(deps): bump mistune and pydantic-settings for CVEs - #83
Merged
Conversation
Resolve 11 known vulnerabilities flagged by osv-scanner: - mistune 3.2.1: 10 CVEs (up to CVSS 8.7), fixed in 3.3.0 - pydantic-settings 2.14.0: GHSA-4xgf-cpjx-pc3j (symlink escape), fixed in 2.14.2 Both bumps are committed together so no intermediate commit leaves a vulnerable lockfile. The mistune upgrade also rewrote parse_inline_math to probe display_math_text and backtick_math_text groups first, and extract_block_quote now returns a 3-tuple, both of which broke mdfluence. - Bump mistune >=3.3.0 and add pydantic-settings >=2.14.2 (pyproject, uv.lock) - Extend inline_math override regex with display/backtick math groups; adopt native (?!\s) so leading-space $ x + y $ is no longer treated as math - Unpack the third return value from extract_block_quote in alerts plugin - Update test to assert leading-space math is rejected
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps
mistune(3.2.1 → 3.3.x) andpydantic-settings(2.14.0 → 2.14.2) to resolve 11 known vulnerabilities flagged by osv-scanner, and adapts the code to mistune 3.3.x API changes. Also fixes the dev-setup instructions in CONTRIBUTING.Changes
mistune>= 3.3.0 — resolves 10 CVEs (up to CVSS 8.7)pydantic-settings>= 2.14.2 — resolves GHSA-4xgf-cpjx-pc3j (symlink escape)inline_mathoverride regex withdisplay_math_text/backtick_math_textgroups (parse_inline_math now probes them first); adopt native(?!\s)so a leading-space$ x + y $is no longer treated as mathextract_block_quotein the alerts pluginTests performed
pytest test_package— 179 passed