chore(deps): update all non-major dependencies to v0.11.20#352
Merged
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe Changesuv image version bump
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related issues
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
✅MegaLinter analysis: Success
Notices📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining See detailed reports in MegaLinter artifacts Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining
|
✅
|
| Descriptor | Linter | Files | Fixed | Errors | Warnings | Elapsed time |
|---|---|---|---|---|---|---|
| ✅ DOCKERFILE | hadolint | 1 | 0 | 0 | 0.23s | |
| checkov | yes | no | 1 | 22.04s | ||
| ✅ REPOSITORY | devskim | yes | no | no | 1.7s | |
| ✅ REPOSITORY | dustilock | yes | no | no | 0.68s | |
| ✅ REPOSITORY | gitleaks | yes | no | no | 0.47s | |
| ✅ REPOSITORY | grype | yes | no | no | 53.06s | |
| ✅ REPOSITORY | kingfisher | yes | no | no | 6.85s | |
| osv-scanner | yes | 18 | no | 6.78s | ||
| ✅ REPOSITORY | secretlint | yes | no | no | 1.71s | |
| ✅ REPOSITORY | semgrep | yes | no | no | 21.8s | |
| ✅ REPOSITORY | syft | yes | no | no | 2.1s | |
| ✅ REPOSITORY | trivy | yes | no | no | 11.77s | |
| ✅ REPOSITORY | trivy-sbom | yes | no | no | 0.13s | |
| ✅ REPOSITORY | trufflehog | yes | no | no | 3.93s |
Detailed Issues
⚠️ REPOSITORY / checkov - 1 warning
error: Ensure the base image uses a non latest version tag
┌─ Dockerfile:9:1
│
9 │ FROM ${BASE_IMAGE} AS base
│ ^^^^^^^^^^^^^^^^^^^^^^^^^^
│
= Ensure the base image uses a non latest version tag
= Ensure the base image uses a non latest version tag
error: Ensure that sudo isn't used
┌─ Dockerfile:40:1
│
40 │ ╭ RUN useradd --create-home libraries && usermod --lock libraries && \
41 │ │ # Warning: the created user has root permissions inside the container
42 │ │ # Warning: you still need to start the ssh process with `sudo service ssh start`
43 │ │ if ! id -u ubuntu; then useradd --create-home --shell /bin/bash --groups sudo ubuntu; fi
│ ╰────────────────────────────────────────────────────────────────────────────────────────────^
│
= Ensure that sudo isn't used
= Ensure that sudo isn't used
error: Ensure that sudo isn't used
┌─ Dockerfile:56:1
│
56 │ ╭ RUN apt-get update && \
57 │ │ apt-get install --yes --no-install-recommends \
58 │ │ # minimal
59 │ │ bash \
· │
75 │ │ git \
76 │ │ && rm -rf /var/lib/apt/lists/*
│ ╰──────────────────────────────────^
│
= Ensure that sudo isn't used
= Ensure that sudo isn't used
warning: Ensure that a user for the container has been created
┌─ Dockerfile:1:1
│
1 │ ╭ # hadolint global ignore=DL3008
2 │ │ # kics-scan disable=fd54f200-402c-4333-a5a4-36ef6709af2f,965a08d7-ef86-4f14-8792-4a3b2098937e
3 │ │ # checkov:skip=CKV_DOCKER_3
4 │ │ ARG BASE_IMAGE=public.ecr.aws/ubuntu/ubuntu:24.04@sha256:8c10ecc59261c77dd866fa8587f1b9cbf172ad8f1253f0af96eaae0fa390c132
· │
111 │ │
112 │ │ HEALTHCHECK CMD ["uv", "pip", "list"]
│ ╰─────────────────────────────────────^
│
= Ensure that a user for the container has been created
= Ensure that a user for the container has been created
warning: 1 warnings emitted
error: 3 errors emitted
⚠️ REPOSITORY / osv-scanner - 18 errors
Scanning dir .
Starting filesystem walk for root: /
Scanned requirements.txt file and found 9 packages
End status: 24 dirs visited, 83 inodes visited, 1 Extract calls, 5.288137ms elapsed, 5.288338ms wall time
Filtered 2 local/unscannable package/s from the scan.
Total 4 packages affected by 20 known vulnerabilities (1 Critical, 8 High, 9 Medium, 1 Low, 1 Unknown) from 1 ecosystem.
20 vulnerabilities can be fixed.
+-------------------------------------+------+-----------+------------+---------+---------------+------------------+
| OSV URL | CVSS | ECOSYSTEM | PACKAGE | VERSION | FIXED VERSION | SOURCE |
+-------------------------------------+------+-----------+------------+---------+---------------+------------------+
| https://osv.dev/PYSEC-2020-173 | 8.7 | PyPI | pip | 9.0.3 | 19.2 | requirements.txt |
| https://osv.dev/GHSA-gpvv-69j7-gwj8 | | | | | | |
| https://osv.dev/PYSEC-2021-437 | 7.1 | PyPI | pip | 9.0.3 | 21.1 | requirements.txt |
| https://osv.dev/GHSA-5xp3-jfq3-5q8x | | | | | | |
| https://osv.dev/PYSEC-2023-228 | 6.8 | PyPI | pip | 9.0.3 | 23.3 | requirements.txt |
| https://osv.dev/GHSA-mq26-g339-26xf | | | | | | |
| https://osv.dev/PYSEC-2026-196 | 5.5 | PyPI | pip | 9.0.3 | 26.1.2 | requirements.txt |
| https://osv.dev/GHSA-4xh5-x5gv-qwph | 5.9 | PyPI | pip | 9.0.3 | 25.3 | requirements.txt |
| https://osv.dev/GHSA-58qw-9mgm-455v | 4.6 | PyPI | pip | 9.0.3 | 26.1 | requirements.txt |
| https://osv.dev/GHSA-6vgw-5pg2-w6jp | 2.0 | PyPI | pip | 9.0.3 | 26.0 | requirements.txt |
| https://osv.dev/GHSA-jp4c-xjxw-mgf9 | 5.3 | PyPI | pip | 9.0.3 | 26.1 | requirements.txt |
| https://osv.dev/PYSEC-2022-43012 | 8.7 | PyPI | setuptools | 9.1.0 | 65.5.1 | requirements.txt |
| https://osv.dev/GHSA-r9hx-vwmv-q579 | | | | | | |
| https://osv.dev/PYSEC-2025-49 | 8.8 | PyPI | setuptools | 9.1.0 | 78.1.1 | requirements.txt |
| https://osv.dev/GHSA-5rjg-fvgr-3xxf | | | | | | |
| https://osv.dev/GHSA-cx63-2mw6-8hw5 | 8.8 | PyPI | setuptools | 9.1.0 | 70.0.0 | requirements.txt |
| https://osv.dev/GHSA-qmgc-5h2g-mvrw | 5.3 | PyPI | filelock | 3.19.1 | 3.20.3 | requirements.txt |
| https://osv.dev/GHSA-w853-jp5j-5j7f | 6.3 | PyPI | filelock | 3.19.1 | 3.20.1 | requirements.txt |
| https://osv.dev/PYSEC-2023-175 | | PyPI | pillow | 9.5.0 | 10.0.1 | requirements.txt |
| https://osv.dev/PYSEC-2023-227 | 8.7 | PyPI | pillow | 9.5.0 | 10.0.0 | requirements.txt |
| https://osv.dev/GHSA-8ghj-p4vj-mr35 | | | | | | |
| https://osv.dev/PYSEC-2026-165 | 5.5 | PyPI | pillow | 9.5.0 | 12.2.0 | requirements.txt |
| https://osv.dev/GHSA-wjx4-4jcj-g98j | | | | | | |
| https://osv.dev/GHSA-3f63-hfp8-52jq | 9.3 | PyPI | pillow | 9.5.0 | 10.2.0 | requirements.txt |
| https://osv.dev/GHSA-44wm-f244-xhp3 | 7.3 | PyPI | pillow | 9.5.0 | 10.3.0 | requirements.txt |
| https://osv.dev/GHSA-j7hp-h8jx-5ppr | 8.8 | PyPI | pillow | 9.5.0 | 10.0.1 | requirements.txt |
| https://osv.dev/GHSA-r73j-pqj5-w3x7 | 5.5 | PyPI | pillow | 9.5.0 | 12.2.0 | requirements.txt |
+-------------------------------------+------+-----------+------------+---------+---------------+------------------+
Notices
📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)
See detailed reports in MegaLinter artifacts
Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)
- Documentation: Custom Flavors
- Command:
npx mega-linter-runner@9.5.0 --custom-flavor-setup --custom-flavor-linters DOCKERFILE_HADOLINT,REPOSITORY_CHECKOV,REPOSITORY_DEVSKIM,REPOSITORY_DUSTILOCK,REPOSITORY_GITLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SEMGREP,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,REPOSITORY_KINGFISHER
Show us your support by starring ⭐ the repository
✅
|
| Descriptor | Linter | Files | Fixed | Errors | Warnings | Elapsed time |
|---|---|---|---|---|---|---|
| ✅ ACTION | actionlint | 5 | 0 | 0 | 0.27s | |
| ✅ ACTION | zizmor | 5 | 0 | 0 | 0 | 1.31s |
| ✅ COPYPASTE | jscpd | yes | no | no | 0.8s | |
| ✅ DOCKERFILE | hadolint | 1 | 0 | 0 | 0.17s | |
| ✅ EDITORCONFIG | editorconfig-checker | 23 | 0 | 0 | 0.02s | |
| ✅ JSON | prettier | 1 | 0 | 0 | 0 | 0.41s |
| ✅ JSON | v8r | 1 | 0 | 0 | 2.11s | |
| ✅ MARKDOWN | markdownlint | 2 | 0 | 0 | 0 | 0.59s |
| ✅ MARKDOWN | markdown-table-formatter | 2 | 0 | 0 | 0 | 0.18s |
| checkov | yes | no | 1 | 23.04s | ||
| ✅ REPOSITORY | gitleaks | yes | no | no | 0.32s | |
| ✅ REPOSITORY | git_diff | yes | no | no | 0.01s | |
| ✅ REPOSITORY | grype | yes | no | no | 54.15s | |
| osv-scanner | yes | 18 | no | 6.71s | ||
| ✅ REPOSITORY | secretlint | yes | no | no | 1.33s | |
| ✅ REPOSITORY | semgrep | yes | no | no | 22.01s | |
| ✅ REPOSITORY | syft | yes | no | no | 1.4s | |
| ✅ REPOSITORY | trivy | yes | no | no | 10.47s | |
| ✅ REPOSITORY | trivy-sbom | yes | no | no | 0.16s | |
| ✅ REPOSITORY | trufflehog | yes | no | no | 3.19s | |
| ✅ SPELL | lychee | 15 | 0 | 0 | 2.93s | |
| ✅ YAML | prettier | 11 | 0 | 0 | 0 | 0.62s |
| ✅ YAML | v8r | 11 | 0 | 0 | 7.19s | |
| ✅ YAML | yamllint | 11 | 0 | 0 | 0.49s |
Detailed Issues
⚠️ REPOSITORY / checkov - 1 warning
error: Ensure the base image uses a non latest version tag
┌─ Dockerfile:9:1
│
9 │ FROM ${BASE_IMAGE} AS base
│ ^^^^^^^^^^^^^^^^^^^^^^^^^^
│
= Ensure the base image uses a non latest version tag
= Ensure the base image uses a non latest version tag
error: Ensure that sudo isn't used
┌─ Dockerfile:40:1
│
40 │ ╭ RUN useradd --create-home libraries && usermod --lock libraries && \
41 │ │ # Warning: the created user has root permissions inside the container
42 │ │ # Warning: you still need to start the ssh process with `sudo service ssh start`
43 │ │ if ! id -u ubuntu; then useradd --create-home --shell /bin/bash --groups sudo ubuntu; fi
│ ╰────────────────────────────────────────────────────────────────────────────────────────────^
│
= Ensure that sudo isn't used
= Ensure that sudo isn't used
error: Ensure that sudo isn't used
┌─ Dockerfile:56:1
│
56 │ ╭ RUN apt-get update && \
57 │ │ apt-get install --yes --no-install-recommends \
58 │ │ # minimal
59 │ │ bash \
· │
75 │ │ git \
76 │ │ && rm -rf /var/lib/apt/lists/*
│ ╰──────────────────────────────────^
│
= Ensure that sudo isn't used
= Ensure that sudo isn't used
warning: Ensure that a user for the container has been created
┌─ Dockerfile:1:1
│
1 │ ╭ # hadolint global ignore=DL3008
2 │ │ # kics-scan disable=fd54f200-402c-4333-a5a4-36ef6709af2f,965a08d7-ef86-4f14-8792-4a3b2098937e
3 │ │ # checkov:skip=CKV_DOCKER_3
4 │ │ ARG BASE_IMAGE=public.ecr.aws/ubuntu/ubuntu:24.04@sha256:8c10ecc59261c77dd866fa8587f1b9cbf172ad8f1253f0af96eaae0fa390c132
· │
111 │ │
112 │ │ HEALTHCHECK CMD ["uv", "pip", "list"]
│ ╰─────────────────────────────────────^
│
= Ensure that a user for the container has been created
= Ensure that a user for the container has been created
warning: 1 warnings emitted
error: 3 errors emitted
⚠️ REPOSITORY / osv-scanner - 18 errors
Scanning dir .
Starting filesystem walk for root: /
Scanned requirements.txt file and found 9 packages
End status: 24 dirs visited, 91 inodes visited, 1 Extract calls, 9.230638ms elapsed, 9.230839ms wall time
Filtered 2 local/unscannable package/s from the scan.
Total 4 packages affected by 20 known vulnerabilities (1 Critical, 8 High, 9 Medium, 1 Low, 1 Unknown) from 1 ecosystem.
20 vulnerabilities can be fixed.
+-------------------------------------+------+-----------+------------+---------+---------------+------------------+
| OSV URL | CVSS | ECOSYSTEM | PACKAGE | VERSION | FIXED VERSION | SOURCE |
+-------------------------------------+------+-----------+------------+---------+---------------+------------------+
| https://osv.dev/PYSEC-2020-173 | 8.7 | PyPI | pip | 9.0.3 | 19.2 | requirements.txt |
| https://osv.dev/GHSA-gpvv-69j7-gwj8 | | | | | | |
| https://osv.dev/PYSEC-2021-437 | 7.1 | PyPI | pip | 9.0.3 | 21.1 | requirements.txt |
| https://osv.dev/GHSA-5xp3-jfq3-5q8x | | | | | | |
| https://osv.dev/PYSEC-2023-228 | 6.8 | PyPI | pip | 9.0.3 | 23.3 | requirements.txt |
| https://osv.dev/GHSA-mq26-g339-26xf | | | | | | |
| https://osv.dev/PYSEC-2026-196 | 5.5 | PyPI | pip | 9.0.3 | 26.1.2 | requirements.txt |
| https://osv.dev/GHSA-4xh5-x5gv-qwph | 5.9 | PyPI | pip | 9.0.3 | 25.3 | requirements.txt |
| https://osv.dev/GHSA-58qw-9mgm-455v | 4.6 | PyPI | pip | 9.0.3 | 26.1 | requirements.txt |
| https://osv.dev/GHSA-6vgw-5pg2-w6jp | 2.0 | PyPI | pip | 9.0.3 | 26.0 | requirements.txt |
| https://osv.dev/GHSA-jp4c-xjxw-mgf9 | 5.3 | PyPI | pip | 9.0.3 | 26.1 | requirements.txt |
| https://osv.dev/PYSEC-2022-43012 | 8.7 | PyPI | setuptools | 9.1.0 | 65.5.1 | requirements.txt |
| https://osv.dev/GHSA-r9hx-vwmv-q579 | | | | | | |
| https://osv.dev/PYSEC-2025-49 | 8.8 | PyPI | setuptools | 9.1.0 | 78.1.1 | requirements.txt |
| https://osv.dev/GHSA-5rjg-fvgr-3xxf | | | | | | |
| https://osv.dev/GHSA-cx63-2mw6-8hw5 | 8.8 | PyPI | setuptools | 9.1.0 | 70.0.0 | requirements.txt |
| https://osv.dev/GHSA-qmgc-5h2g-mvrw | 5.3 | PyPI | filelock | 3.19.1 | 3.20.3 | requirements.txt |
| https://osv.dev/GHSA-w853-jp5j-5j7f | 6.3 | PyPI | filelock | 3.19.1 | 3.20.1 | requirements.txt |
| https://osv.dev/PYSEC-2023-175 | | PyPI | pillow | 9.5.0 | 10.0.1 | requirements.txt |
| https://osv.dev/PYSEC-2023-227 | 8.7 | PyPI | pillow | 9.5.0 | 10.0.0 | requirements.txt |
| https://osv.dev/GHSA-8ghj-p4vj-mr35 | | | | | | |
| https://osv.dev/PYSEC-2026-165 | 5.5 | PyPI | pillow | 9.5.0 | 12.2.0 | requirements.txt |
| https://osv.dev/GHSA-wjx4-4jcj-g98j | | | | | | |
| https://osv.dev/GHSA-3f63-hfp8-52jq | 9.3 | PyPI | pillow | 9.5.0 | 10.2.0 | requirements.txt |
| https://osv.dev/GHSA-44wm-f244-xhp3 | 7.3 | PyPI | pillow | 9.5.0 | 10.3.0 | requirements.txt |
| https://osv.dev/GHSA-j7hp-h8jx-5ppr | 8.8 | PyPI | pillow | 9.5.0 | 10.0.1 | requirements.txt |
| https://osv.dev/GHSA-r73j-pqj5-w3x7 | 5.5 | PyPI | pillow | 9.5.0 | 12.2.0 | requirements.txt |
+-------------------------------------+------+-----------+------------+---------+---------------+------------------+
Notices
📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)
See detailed reports in MegaLinter artifacts
Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)
- Documentation: Custom Flavors
- Command:
npx mega-linter-runner@9.5.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,ACTION_ZIZMOR,COPYPASTE_JSCPD,DOCKERFILE_HADOLINT,EDITORCONFIG_EDITORCONFIG_CHECKER,JSON_V8R,JSON_PRETTIER,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SEMGREP,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_LYCHEE,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R
Show us your support by starring ⭐ the repository
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
0.11.19→0.11.20Release Notes
astral-sh/uv (ghcr.io/astral-sh/uv)
v0.11.20Released on 2026-06-10.
Enhancements
--emit-index-urland--emit-find-linkstouv export(#18370)--find-linkssupport foruv pip list(#16103)uv python install(#19691)Preview features
uv upgradecommand (#19678)uv upgrade(#19742)Configuration
UV_NO_INSTALL_PROJECT,UV_NO_INSTALL_WORKSPACE,UV_NO_INSTALL_LOCAL(#19323)Performance
Bug fixes
VIRTUAL_ENVthroughcygpathinsidefishon Windows (#19703)Documentation
--find-linkscaching behavior (#19585)Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.