Repository navigation
Conversation
…and black pip-audit flags 40 advisories published after main's last green run: pillow 12.3.0 (37, fixed in 13.0.0), gitpython 3.1.62 (CVE-2026-114145), certifi 2024.8.30 (PYSEC-2026-4320) and black 26.3.1 (CVE-2026-114134). - pillow 13 requires Python 3.11, and every streamlit before 1.66.1 caps pillow<13, so on Python >= 3.11 pillow moves to 13 and streamlit to 1.66.1 (which runs on Starlette/uvicorn instead of Tornado). Python 3.10 stays on pillow 12.3.0 and streamlit 1.56.0: no fixed pillow supports it. - GitPython floor raised to 3.2.1; certifi gets a floor in the transitive security constraints; the black dev floor is raised to 26.10.1. Only the affected poetry.lock entries were spliced in, since a plain `poetry lock` on main also drops about 20 unrelated older-Python entries. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HwkxN8YriHhdXBwMc4sd8h
|
No actionable comments were generated in the recent review.
 |
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Updates Docs |  |
The PR changes only pyproject.toml and poetry.lock; it adds no documentation. CLAUDE.md states that user-visible changes to supported Python versions or pre-installed packages require matching d… |
Check the corresponding documentation PR in deepnote/deepnote and the roadmap entry in deepnote/deepnote-internal. Add or update documentation for the dependency and Streamlit/Pillow support changes if it is missing. |
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly identifies the dependency updates intended to resolve pip-audit findings. It matches the main changes to Pillow, GitPython, Certifi, and Black. Docstring Coverage No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
-
Full details: Updates Docs
-
Explanation
The PR changes only
pyproject.tomlandpoetry.lock; it adds no documentation.CLAUDE.mdstates that user-visible changes to supported Python versions or pre-installed packages require matching documentation indeepnote/deepnote. This checkout does not provide the publicdeepnote/deepnoterepository or the privatedeepnote/deepnote-internalrepository, so the required documentation and roadmap updates cannot be verified.Resolution
Check the corresponding documentation PR in
deepnote/deepnoteand the roadmap entry indeepnote/deepnote-internal. Add or update documentation for the dependency and Streamlit/Pillow support changes if it is missing.
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
|
📦 Python package built successfully!
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #143 +/- ##
=======================================
Coverage 78.17% 78.17%
=======================================
Files 120 120
Lines 6837 6837
Branches 990 990
=======================================
Hits 5345 5345
Misses 1182 1182
Partials 310 310
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. |
|
🚀 Review App Deployment Started
|
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HwkxN8YriHhdXBwMc4sd8h
Summary
Audit - ProductionandAudit - Allhave failed on every PR since about 2026-10-22. The cause is 40 advisories, in 4 packages, published aftermain's last green run. This PR fixes all of them on Python 3.11–3.14. On Python 3.10 the 37 pillow advisories remain, because no fixed pillow release supports 3.10 (details below).Changes
serverextra)Why each change looks the way it does
Image.open().load()reaches with default settings. pillow 13 requires Python ≥ 3.11, so the constraint is split. Ignoring the advisories wasn't a good option: they are reachable from opening an untrusted image, and a fix exists for 3.11+. This follows fix(deps): resolve pip-audit failures #133, which accepted pymongo's breaking change for the same reason.pillow<13, so pillow 13 needs streamlit ≥ 1.66.1, which itself requires Python ≥ 3.11. Its floor is declared explicitly, as dnspython's was next to the pymongo bump in fix(deps): resolve pip-audit failures #133.<4, and the locked gitdb 4.0.11 already satisfies 3.2.1'sgitdb>=4.0.1,<5. Streamlit 1.66 no longer depends on GitPython. It stays installed on all versions through our own constraint, so it doesn't disappear from user environments.use_pyproject: true), which this repo doesn't use. A fix exists and black 26.10.1 reformats nothing (217 files unchanged), so the floor is bumped rather than ignored. black also reaches theserverextra throughdeepnote-python-lsp-server(black = "*"). There, fresh installs resolve the latest black, and the advisory isn't reachable at runtime, so no runtime constraint was added.serverextra on ≥ 3.11. blinker is now needed only on 3.10.streamlit runon 1.66.1, using the flags frominstaller/module/streamlit.pyand a cross-originOriginheader:/_stcore/healthand/return 200read_streamlit_token_from_context()and_read_streamlit_app_id_from_context()still read the viewer'sstreamlit-tokencookie and the app host fromst.contextpython_version < "3.11"pin of pillow 12.3.0 reports "No known vulnerabilities found"). This is also why the 3.10 pins need noignore-vulnsentry.Lock file
Only the entries for these 12 packages changed: black, blinker, certifi, gitpython, h11, itsdangerous, pillow, python-multipart, starlette, streamlit, uvicorn, websockets.
A plain
poetry lockonmainalso drops 20 unrelated older-Python entries (pydantic 2.11.7, pyzmq 26.2.0, pyspark 4.0.1, …). So, as in #133, the new entries were spliced into the existing lock from a fresh lock of the newpyproject.toml. A comparison confirmed that the fresh lock differs from the spliced one only in that unrelated drift.Testing
poetry check --lockpasses (Poetry 2.2.0, as in CI).pip-audit with CI's flags and ignores:
mainfinds 40 known vulnerabilities in 4 packages; this branch finds none.The full export (all extras + dev) resolves on Python 3.10–3.14 with no package outside the lock, except
tomlion 3.11 (via coverage), which is already the case onmain.Unit tests, in venvs built from the exported lock with all extras:
On 3.12,
main's lock gives the same counts, skips and warnings.Not in this PR (found while auditing, already on
main)CI's audit exports only the main dependencies: no
serverextra, no dev group. An audit of everything finds these, all present onmainand unchanged here:jupyter-server2.20.0 (serverextra): PYSEC-2026-4054, fixed in 2.21.0anyio4.4.0: PYSEC-2026-4024, PYSEC-2026-4025, fixed in 4.14.2virtualenv20.36.1 (dev): 19 advisories, fixed in 21.14.9pyspark3.5.5 (dev, < 3.13): PYSEC-2026-3966, fixed in 3.5.8Making CI audit extras and other Python versions would catch these, but it is a separate change.
🤖 Generated with Claude Code
https://claude.ai/code/session_01HwkxN8YriHhdXBwMc4sd8h
Summary by CodeRabbit