Skip to content

fix(security): update vulnerable Python dependencies - #15

Merged
partrita merged 2 commits into
mainfrom
security/dependabot-fixes-2026-09
Sep 7, 2026
Merged

partrita merged 2 commits into
mainfrom
security/dependabot-fixes-2026-09

Conversation

@partrita

@partrita partrita commented Sep 7, 2026

Copy link
Copy Markdown
Owner

Summary

  • update PyPDF2 from 1.27.5 to 1.27.9 to fix CVE-2023-36810 (quadratic runtime on malformed PDFs)
  • update Pygments from 2.19.2 to 2.20.0 to fix CVE-2026-4539 (ReDoS in AdlLexer)

Scope

Only dependencies with a confirmed version-level security fix are changed. Existing versions of Jinja2, jupyter-server, Pillow, TensorFlow, PyTorch, and other dependencies were left unchanged where the reported alerts are already covered by the versions currently pinned.

Validation

  • Confirmed PyPDF2 1.27.9 is the patched release for CVE-2023-36810.
  • Confirmed Pygments 2.20.0 is the patched release for CVE-2026-4539.

@github-actions

github-actions Bot commented Sep 7, 2026

Copy link
Copy Markdown

Hi @partrita! 👋

Thank you for submitting a pull request! We appreciate your contribution and will review your changes as soon as possible.

@partrita
partrita merged commit fce0b18 into main Sep 7, 2026
1 check passed
@partrita
partrita deleted the security/dependabot-fixes-2026-09 branch September 7, 2026 06:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant