Repository navigation
Bump Python to fix filelock vulnerability - #87
Merged
Merged
Conversation
|
@lasp/dev-guide-admins — this PR is ready for review. |
Collaborator
Author
|
@mmaclay Do you know how to investigate a pre-commit.ci error? When I click on the failed check, it just takes me to a page that says there's an error but doesn't link to a log |
Member
|
@vmartinez-cu I think this might be due to the merge conflict on this PR. I will take a look at it. |
Member
|
@copilot resolve the merge conflicts in this pull request |
vmartinez-cu
force-pushed
the
filelock-vulnerability
branch
from
November 3, 2026 16:42
87d1023 to
ff42f24
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Change Summary
Dependabot identified vulnerabilities with filelock but wasn't able to automatically fix it since the filelock package was being resolved to an older version than the patched release. The lockfile had filelock
3.24.3, while the safer patched versions are4.2.1+and the current fixed release available in PyPI is4.2.7.Root cause
The project declared Python support as:
python = ">=3.10,<4"This allowed the resolver to remain in the Python 3.10-compatible dependency set, which excludes the patched filelock release. The patched filelock versions require Python 3.11+. Older virtualenv and pre-commit dependency constraints were also part of this chain, so the resolver could not move to the patched package under the older Python minimum.
Fix
Updated the project metadata to require a newer Python version:
python = ">=3.11,<4"Then regenerated the lockfile with Poetry, which updated the dependency tree to the patched versions:
filelock→4.2.7virtualenv→21.15.2pre-commit→4.7.0tomliandtyping-extensionsremoved, since they were only needed on Python 3.10Additional unrelated change: