From f5a5fa93af83dd91dba8e34fd9ce9ee7b0d14e2e Mon Sep 17 00:00:00 2001 From: lebaudantoine Date: Thu, 4 Jun 2026 17:22:52 +0200 Subject: [PATCH] =?UTF-8?q?=E2=AC=86=EF=B8=8F(agents)=20upgrade=20idna=20t?= =?UTF-8?q?o=20>=3D3.15=20to=20address=20CVE-2026-45409?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Pin idna to >=3.15 via uv constraint-dependencies to fix a moderate severity (CVSS 5.3) information disclosure vulnerability. The flaw is network-exploitable with no authentication required. --- src/agents/uv.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/agents/uv.lock b/src/agents/uv.lock index d0bc06d2..1fde021b 100644 --- a/src/agents/uv.lock +++ b/src/agents/uv.lock @@ -638,11 +638,11 @@ wheels = [ [[package]] name = "idna" -version = "3.12" +version = "3.18" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/22/12/2948fbe5513d062169bd91f7d7b1cd97bc8894f32946b71fa39f6e63ca0c/idna-3.12.tar.gz", hash = "sha256:724e9952cc9e2bd7550ea784adb098d837ab5267ef67a1ab9cf7846bdbdd8254", size = 194350, upload-time = "2026-04-21T13:32:48.916Z" } +sdist = { url = "https://files.pythonhosted.org/packages/cd/63/9496c57188a2ee585e0f1db071d75089a11e98aa86eb99d9d7618fc1edce/idna-3.18.tar.gz", hash = "sha256:ffb385a7e039654cef1ab9ef32c6fafe283c0c0467bba1d9029738ce4a14a848", size = 196711, upload-time = "2026-06-02T14:34:07.794Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/53/b2/acc33950394b3becb2b664741a0c0889c7ef9f9ffbfa8d47eddb53a50abd/idna-3.12-py3-none-any.whl", hash = "sha256:60ffaa1858fac94c9c124728c24fcde8160f3fb4a7f79aa8cdd33a9d1af60a67", size = 68634, upload-time = "2026-04-21T13:32:47.403Z" }, + { url = "https://files.pythonhosted.org/packages/1e/5e/d4e9f1a599fb8e573b7b87160658329fbf28d19eac2718f51fc3def3aa5a/idna-3.18-py3-none-any.whl", hash = "sha256:7f952cbe720b688055e3f87de14f5c3e5fdaa8bc3928985c4077ca689de849a2", size = 65455, upload-time = "2026-06-02T14:34:06.319Z" }, ] [[package]]