From 2a620b3452af1aac39707540f491b5c8e591f788 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 20 Jul 2026 09:19:25 +0000 Subject: [PATCH 1/2] ci(deps): bump actions/setup-python from 6 to 7 Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6 to 7. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/benchmarks.yml | 2 +- .github/workflows/pre-commit.yaml | 2 +- .github/workflows/publish.yml | 2 +- .github/workflows/security.yml | 2 +- .github/workflows/test-jvspatial.yaml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/benchmarks.yml b/.github/workflows/benchmarks.yml index 487e66b..4affb1a 100644 --- a/.github/workflows/benchmarks.yml +++ b/.github/workflows/benchmarks.yml @@ -60,7 +60,7 @@ jobs: - uses: actions/checkout@v7 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@v7 with: python-version: '3.11' diff --git a/.github/workflows/pre-commit.yaml b/.github/workflows/pre-commit.yaml index 0e762b2..b7040ef 100644 --- a/.github/workflows/pre-commit.yaml +++ b/.github/workflows/pre-commit.yaml @@ -17,7 +17,7 @@ jobs: uses: actions/checkout@v7 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@v7 with: python-version: '3.12' diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 2632a0c..fadd75c 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -38,7 +38,7 @@ jobs: token: ${{ secrets.GITHUB_TOKEN }} - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@v7 with: python-version: '3.11' diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index cd118a5..d4e8480 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -32,7 +32,7 @@ jobs: - uses: actions/checkout@v7 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@v7 with: python-version: '3.11' diff --git a/.github/workflows/test-jvspatial.yaml b/.github/workflows/test-jvspatial.yaml index b99ea94..6a0334a 100644 --- a/.github/workflows/test-jvspatial.yaml +++ b/.github/workflows/test-jvspatial.yaml @@ -18,7 +18,7 @@ jobs: uses: actions/checkout@v7 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@v7 with: python-version: ${{ matrix.python-version }} From 53b3a9c53e84e7666f117dda42ca5fa877007560 Mon Sep 17 00:00:00 2001 From: Eldon Marks Date: Fri, 31 Jul 2026 12:55:20 -0400 Subject: [PATCH 2/2] ci(security): upgrade setuptools before pip-audit resolves the dep set MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The pip-audit job was failing on PYSEC-2026-3447 in setuptools 79.0.1 — the version bundled with the runner's Python, which lands in the freeze list the audit consumes. setuptools is neither a declared runtime dependency of jvspatial nor vendored into its wheel, so the finding said nothing about the project's own dependency hygiene while still reddening every PR that touches pyproject.toml or this workflow. Upgrade setuptools alongside pip so the audited environment carries the fixed 83.0.0. Not floored in pyproject's [build-system] requires instead: setuptools 83 requires Python >=3.10 while jvspatial supports >=3.9, so pinning it there would make a source build unresolvable on 3.9. This job pins 3.11, so the upgrade is safe here and keeps the audit reporting on our dependencies. Verified in a clean 3.11 venv: pip-audit --strict reports "No known vulnerabilities found" after the upgrade. Co-Authored-By: Claude Opus 5 --- .github/workflows/security.yml | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index d4e8480..18dd38b 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -38,7 +38,19 @@ jobs: - name: Install project + audit tooling run: | - python -m pip install --upgrade pip + # setuptools is upgraded explicitly, not just pip. The runner + # image ships whatever setuptools its Python bundled, that + # version lands in the freeze list below, and the audit then + # reports a CVE in a build tool jvspatial neither declares as a + # runtime dependency nor vendors into its wheel (PYSEC-2026-3447 + # in setuptools 79.0.1, fixed in 83.0.0). + # + # Deliberately NOT floored in pyproject's [build-system] + # requires: setuptools 83 needs Python >=3.10 while jvspatial + # supports >=3.9, so pinning it there makes a source build + # unresolvable on 3.9. This job pins 3.11, so upgrading here is + # safe and keeps the audit signal about *our* dependencies. + python -m pip install --upgrade pip setuptools pip install pip-audit # Resolve the project's full dependency set so the audit # sees the same packages adopters would install.