Skip to content

fix: resolve 1 security vulnerabilities#366

Draft
james-snyk wants to merge 1 commit into
mainfrom
fix/vuln-bot-2026-05-27-110237
Draft

fix: resolve 1 security vulnerabilities#366
james-snyk wants to merge 1 commit into
mainfrom
fix/vuln-bot-2026-05-27-110237

Conversation

@james-snyk

Copy link
Copy Markdown
Contributor

🔒 Security Vulnerability Fixes

This PR addresses 1 security vulnerabilities detected by Snyk.

✅ Fixed Vulnerabilities

HIGH — Arbitrary Code Injection (CVE-2026-4800)

Upgraded snyk-poetry-lockfile-parser from ^1.9.1 to ^1.9.2

Reason: snyk-poetry-lockfile-parser@1.9.2 declares lodash@'^4.18.1', raising the floor and ensuring npm install resolves lodash to 4.18.1 (fixed). Bumping the parent floor from ^1.9.1 to ^1.9.2 tightens the constraint without requiring an override.

Dependency Path:

  • snyk-python-plugin > snyk-poetry-lockfile-parser > lodash

@snyk-io

snyk-io Bot commented May 27, 2026

Copy link
Copy Markdown

Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues
Licenses 0 0 0 0 0 issues
Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant