[RobotGenerated] Resolve open Dependabot security alerts in Go and Python dependencies. - #104
Merged
Merged
Conversation
- Upgrade google.golang.org/grpc to v1.83.2 (fixes alerts 73, 100, 103). - Migrate github.com/jackc/pgx v3 to github.com/jackc/pgx/v5 v5.10.0 in Historical-ROA (fixes alerts 45, 46, 76). - Migrate github.com/osrg/gobgp to github.com/osrg/gobgp/v3 v3.37.0 in mrt_converter (fixes alerts 41, 43, 44, 79). - Update cloud.google.com/go/bigquery to v1.72.0, removing the vulnerable github.com/apache/thrift dependency (fixes alert 77). - Update ObjExists in pkg/mrt_converter to use errors.Is(err, storage.ErrObjectNotExist) for cloud storage client compatibility. - Update python-client/requirements.txt: pyasn1==0.6.4, pyasn1-modules==0.4.1, idna==3.15, urllib3==2.7.0, requests==2.33.0 (fixes alerts 71, 74, 78, 80, 81, 97, 98, 101). - Note: proto/go.mod alerts (15, 19, 72, 99, 102) were eliminated by module consolidation into root go.mod with protobuf v1.36.11 and gRPC v1.83.2. TAG=agy CONV=04d7abf4-9e7c-4d1e-a96a-b563b1109e65
Member
|
Python says the dependency tree is not happy: |
added 3 commits
September 2, 2026 23:23
Remove deleted Historical-ROA/movefromoldtonew and obsolete dependencies (pgx, log), keeping upgraded dependencies in go.mod and go.sum. TAG=agy CONV=58107ef1-7a62-4bfe-a45b-0e838dcbe775
Resolve pip dependency conflict with protobuf==5.29.6 by upgrading grpcio and grpcio-tools from 1.62.2 to 1.70.0. TAG=agy CONV=58107ef1-7a62-4bfe-a45b-0e838dcbe775
Bump packaging to 24.2 and pluggy to 1.5.0 to resolve pip dependency conflict with pytest 9.0.3 (requires packaging>=22, pluggy>=1.5). TAG=agy CONV=58107ef1-7a62-4bfe-a45b-0e838dcbe775
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
There were a slew of dependabot issues, so I set the robot loose to resolve them.