Repository navigation
Conversation
…version The Snyk audit bumped virtualenv to 21.14.7 (SNYK-PYTHON-VIRTUALENV-21282484, SNYK-PYTHON-VIRTUALENV-21282509, CVE-2026-113725) and added dulwich>=1.2.20 (SNYK-PYTHON-DULWICH-22220108, CVE-2026-122299) in ci/requirements.txt and requirements.txt. Both packages are transitive dependencies of Poetry and this branch pins poetry==1.8.5, which requires virtualenv<21.0.0 and dulwich<0.22.0. The audit pins therefore make the CI pip resolution fail with ResolutionImpossible. Poetry cannot be upgraded on this stabilization branch, so ignore the advisories. They affect build/CI tooling only (Poetry is not a runtime dependency of tilecloud-chain). Once ignored, the audit stops adding the infeasible pins and the Continuous integration check passes.
sbrunner
added
security
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add three
.snykignore entries so the Snyk audit stops pinningvirtualenv/dulwichto versions incompatible with the Poetry pinned on this branch.Context
ghci/audit/snyk/1.21) fails theContinuous integrationcheck withResolutionImpossible.virtualenvto21.14.7(SNYK-PYTHON-VIRTUALENV-21282484,SNYK-PYTHON-VIRTUALENV-21282509, CVE-2026-113725) and addsdulwich>=1.2.20(SNYK-PYTHON-DULWICH-22220108, CVE-2026-122299) inci/requirements.txtandrequirements.txt.poetry==1.8.5, which requiresvirtualenv<21.0.0anddulwich<0.22.0. The pins therefore cannot be resolved together.Implementation Details
.snykis the sanctioned mechanism: the audit already respects it (that is why the other dulwich/poetry advisories are not re-pinned). Once merged, the next audit cycle drops the infeasible requirements pins.Impact/Risks