Skip to content

fix(deps): update dependencies to resolve security vulnerabilities#158

Merged
astanziola merged 1 commit intomainfrom
fix/update-vulnerable-deps
Feb 14, 2026
Merged

fix(deps): update dependencies to resolve security vulnerabilities#158
astanziola merged 1 commit intomainfrom
fix/update-vulnerable-deps

Conversation

@astanziola
Copy link
Member

Summary

  • Bump nbconvert lower bound to >=7.17.0 (uncontrolled search path fix)
  • Re-lock all dependencies to pull in patched versions of pillow, urllib3, virtualenv, and filelock
  • All 5 Dependabot security alerts resolved
  • 319 tests pass

Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the development dependency constraints to address a reported nbconvert security vulnerability by raising the minimum supported nbconvert version.

Changes:

  • Bump nbconvert lower bound in the dev dependency group from >=7.16.0 to >=7.17.0.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@astanziola astanziola merged commit 4f5f82b into main Feb 14, 2026
11 checks passed
@astanziola astanziola deleted the fix/update-vulnerable-deps branch February 14, 2026 09:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants