Skip to content

build(deps): patch transitive security advisories #400

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
seonghobae wants to merge 5 commits into
base: main
Choose a base branch
from
Draft

build(deps): patch transitive security advisories #400

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
6c9db08
build(deps): patch transitive security advisories
seonghobae Sep 4, 2026
84bc0e2
Merge remote-tracking branch 'origin/main' into codex/security-transi…
seonghobae Sep 4, 2026
d942322
test(ci): cover event-specific Python matrix
seonghobae Sep 4, 2026
ca31a26
test(ci): bind Python matrix to event
seonghobae Sep 4, 2026
3d4efaa
repair(ci): keep security lane out of Python policy
seonghobae Sep 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 7 additions & 3 deletions office/tests/test_python_support_contract.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,10 +50,14 @@ def test_python_support_range_matches_classifiers_and_ci_matrix() -> None:
office_job = _workflow_job_block(workflow, "office")
assert "runs-on: ubuntu-24.04" in office_job
assert "runs-on: ubuntu-latest" not in office_job
matrix_match = re.search(r'python-version:\s*\[([^\]]+)\]', office_job)
matrix_match = re.search(r"python-version:\s*(.+)", office_job)
assert matrix_match is not None
matrix_versions = tuple(re.findall(r'"(3\.\d+)"', matrix_match.group(1)))
assert matrix_versions == SUPPORTED_PYTHON_VERSIONS
pull_request_versions, push_versions = (
tuple(re.findall(r'"(3\.\d+)"', versions))
for versions in re.findall(r"fromJSON\('(\[[^']+\])'\)", matrix_match.group(1))
)
assert pull_request_versions == (SUPPORTED_PYTHON_VERSIONS[-1],)
assert push_versions == SUPPORTED_PYTHON_VERSIONS
Comment thread
seonghobae marked this conversation as resolved.
Outdated


def test_python_support_documentation_matches_the_fixed_ci_environment() -> None:
Expand Down
63 changes: 32 additions & 31 deletions pnpm-lock.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

9 changes: 7 additions & 2 deletions pnpm-workspace.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,11 @@ trustPolicyIgnoreAfter: 43200
# - vite<6.4.3: GHSA-fx2h-pf6j-xcff / GHSA-4w7w-66w2-5vf9 / GHSA-v6wh-96g9-6wx3
# (vitest's @vitest/mocker still resolves a transitive vite@5)
# - esbuild<0.25: GHSA-67mh-4wv8-2f99 (dragged in by the transitive vite@5)
# - fast-uri<3.1.5: GHSA-v2hh-gcrm-f6hx / GHSA-7p8r-x3mc-p8w7 (via ajv in vite-plugin-dts)
# - fast-uri<3.1.6: GHSA-v2hh-gcrm-f6hx / GHSA-7p8r-x3mc-p8w7 /
# GHSA-5jgf-p345-68v8 / GHSA-f65p-4m7j-42xc / GHSA-fph4-wmhf-6fwf /
# GHSA-jqff-g426-hqxp (via ajv in vite-plugin-dts)
# - browserslist<4.28.7: GHSA-c83g-rgw3-j3cx / GHSA-73wf-gq98-2v4g
# (via Babel in Storybook and Vite's React plugin)
# - nanoid<3.3.18: GHSA-2v37-7h3g-55p8 (via postcss)
# - postcss<=8.5.22: GHSA-r28c-9q8g-f849 / GHSA-fxqj-rqcc-2cmp (source-map path traversal via vite)
# - brace-expansion<=5.0.7: GHSA-mh99-v99m-4gvg (unbounded-expansion DoS). The
Expand All @@ -33,7 +37,8 @@ trustPolicyIgnoreAfter: 43200
overrides:
vite: ^6.4.3
esbuild: ^0.25.0
fast-uri: ^3.1.5
fast-uri: ^3.1.6
browserslist: ^4.28.7
nanoid: ^3.3.18
postcss: ^8.5.23
brace-expansion: ^5.0.8
Expand Down
Loading