Repository navigation
Bump dev/doc tooling to clear the remaining Dependabot alerts #640
Description
Context
After the shipping-path fix landed (#639: urllib3 2.8.0), the Security tab still shows 50 open Dependabot alerts, all in dev/doc tooling pulled in only by the nox/doc/lint dependency-groups. The shipping set is 15 packages (verified by a production-only uv export --no-default-groups --all-extras), and none of these are in it — nothing reaches a consumer who runs pip install b2sdk.
This issue drives the Security tab toward 0 by bumping the dev dependency-groups; any alert that genuinely cannot be fixed under the project's constraints is documented for dismissal with a verified "not in the shipped artifact" reason.
Fix map
| Package | Alerts | Source group | Fixed version | Notes |
|---|---|---|---|---|
virtualenv |
19 | nox |
21.14.9 | transitive; re-lock |
tornado |
13 | doc (pinned tornado>=6.3.3) |
6.6 | floor already allows the fix |
filelock |
9 | nox/virtualenv |
4.2.1 | transitive; re-lock |
starlette |
5 | doc (sphinx-autobuild) |
1.3.1 (0.x→1.x major) | may require a newer sphinx-autobuild; Dependabot's starlette 1.x bump failed lint on the sibling CLI repo |
anyio |
2 (1 critical) | doc (sphinx-autobuild) |
4.14.2 | transitive; re-lock |
setuptools |
2 | lint (uncapped) |
83.0.0 / 84.1.0 | no version cap here; bumps cleanly |
Acceptance criteria
virtualenv,filelock,tornado,anyio,setuptoolsresolve at or above their fixed versions inuv.lock.starletteresolves >= 1.3.1 if a compatiblesphinx-autobuildexists; if moving to starlette 1.x breaksnox -vs lint/doc, do not force it — document it here for dismissal instead.nox -vs lint unitpasses with all B2 credential vars unset;nox -vs towncrier_checkpasses (add achangelog.d/fragment).- No change to
[project].dependenciesruntime bounds (dev groups only). - After merge, the Security tab reads 0 open (any documented-stuck dev-only alert dismissed as "vulnerable code not in use — dev/doc tooling, not in the shipped artifact").
Scope / out of scope
In scope: the nox/doc/lint dependency-groups and the resulting uv.lock.
Out of scope: runtime dependencies (already fixed in #639) and the shipped b2sdk wheel's surface.
Links
- Shipping-path fix already merged: Bump urllib3 to 2.8.0 to close shipping advisories #639
- Superseded Dependabot PR (starlette): Bump starlette from 0.51.0 to 1.0.1 in the uv group across 1 directory #580
Activity