chore(deps): bump click to 8.4.2 for PYSEC-2026-2132 - #599
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR addresses a reported dependency vulnerability (PYSEC-2026-2132) by adding an explicit cap for click in the load optional dependency group (where it is pulled transitively via locust → flask), and relocks to a non-vulnerable resolved version.
Changes:
- Add
click>=8.3.3,<9to the[project.optional-dependencies].loadgroup with an advisory/path comment. - Update
uv.locksoclickresolves to8.4.2and is recorded under theloadextra metadata. - Update selftest classification to include
clickin the capped optionalloadgroup.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
pyproject.toml |
Adds an explicit click pin/cap in the load extra to remediate PYSEC-2026-2132. |
uv.lock |
Updates the locked click version to 8.4.2 and reflects the load extra requiring click>=8.3.3,<9. |
selftests/test_dependency_pins.py |
Classifies click under CAPPED_OPTIONAL["load"] to satisfy the dependency pinning policy guard. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Contributor
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The scheduled dependency audit reports one known vulnerability: click 8.3.1, PYSEC-2026-2132, fixed in 8.3.3.
click reaches the tree only through flask, which comes from locust, which lives in the
[load]optional group. The pin therefore goes in[load]rather than the base dependencies, alongside the three CVE pins already there (msgpack,python-engineio,python-socketio), and follows the same comment convention naming the advisory and the transitive path. Relocking resolved click to 8.4.2, comfortably above the 8.3.3 floor.selftests/test_dependency_pins.pycaught the new entry and required it be classified, which is the guard working as designed, soclickis added toCAPPED_OPTIONAL["load"]. The pin already carries the<9upper bound the policy requires.Verification
uv run --all-extras --with pip-audit pip-audit --skip-editable, the same invocation CI uses, now reports "No known vulnerabilities found" with only the expected editable-install skip forposit-vip. Selftests pass with theloadextra installed, apart from the pre-existing macOS load-engine failure fixed separately in #597. Ruff check and format clean.Closes #459