Fix 29 Dependabot alerts in Procore-Sample-Python - #11
Closed
pcor-neoword wants to merge 2 commits into
Closed
Conversation
…ll deps - Bump Python requirement from 3.7 (EOL) to 3.11 - Add .tool-versions pinned to python 3.11.15 (asdf) - flask >=3.0.3 → resolves to 3.1.3 (fixes alerts #10, #39) - requests >=2.32.3 → resolves to 2.34.2 (fixes alerts #11, #23, #30, #40) - python-dotenv >=1.0.2 → resolves to 1.2.2 (fixes alert #41) - Regenerate Pipfile.lock — indirect deps resolve to safe versions: werkzeug 3.1.8 (fixes alerts #7,8,22,26,33,37,38) jinja2 3.1.6 (fixes alerts #19,21,28,29) urllib3 2.7.0 (fixes alerts #14,17,24,32,34,35,36,42) certifi 2026.7.22 (fixes alerts #6,13) idna 3.18 (fixes alerts #20,43) Co-Authored-By: Claude <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR updates the project’s Python runtime requirement and dependency set to remediate Dependabot security alerts by upgrading vulnerable direct and transitive packages via Pipenv locking.
Changes:
- Bump required Python version from 3.7 to 3.11 and add an asdf
.tool-versionsentry. - Update direct dependency constraints in
Pipfile. - Regenerate
Pipfile.lockto resolve Dependabot alerts through updated dependency resolution.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| Pipfile | Updates Python requirement and raises minimum versions for key dependencies. |
| Pipfile.lock | Regenerated lockfile reflecting upgraded direct/transitive dependency versions and Python 3.11 requirement. |
| .tool-versions | Pins local toolchain Python version for asdf users. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Pin direct deps to the exact versions already in Pipfile.lock so a fresh pipenv lock cannot resolve older-but-still-safe releases: flask >=3.1.3, requests >=2.34.2, requests-auth >=8.0.0, python-dotenv >=1.2.2 Co-Authored-By: Claude <noreply@anthropic.com>
Author
|
Fixed in 6807369 — lower bounds in |
Author
|
The build on this repo is borked... backing out PR. |
pcor-neoword
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.tool-versionsfor asdf (python 3.11.15)Pipfileso pip resolver picks safe versionsPipfile.lock— all 29 Dependabot alerts resolved via transitive dependency resolutionNo application code changes. App starts cleanly on port 3000 with the new deps.
Test plan
pipenv run python app.pystarts Flask on port 3000 without errors🤖 Generated with Claude Code