Skip to content

deps: bump anyio to 4.14.2 in worker_plan (GHSA-82r6-8w77-94w6, GHSA-3w57-8xmc-8v26) - #901

Open
katsugtgz wants to merge 1 commit into
PlanExeOrg:mainfrom
katsugtgz:deps/anyio-4.14.2
Open

katsugtgz wants to merge 1 commit into
PlanExeOrg:mainfrom
katsugtgz:deps/anyio-4.14.2

Conversation

@katsugtgz

Copy link
Copy Markdown
Contributor

Updates anyio to address GHSA-82r6-8w77-94w6 and GHSA-3w57-8xmc-8v26.

Evidence:

  • worker_plan/pyproject.toml pinned anyio==4.14.0
  • both advisories affect anyio < 4.14.2; first patched version is 4.14.2
  • OSV query for anyio@4.14.2 (PyPI) returns no open advisories
  • updated version: anyio==4.14.2

Validation:

  • worker_plan/.venv/bin/python test.py with the bump: Ran 403 tests, same 25 pre-existing errors and 13 skips as on main (diff of failure sets is empty)
  • the 25 errors are environmental (missing pytest module and mcp_cloud Postgres host database_postgres), present on the base commit too
  • pip install -e worker_plan resolves with anyio 4.14.2 on Python 3.13

Scope: dependency pin update in worker_plan/pyproject.toml only.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant