From aeafce2749eead513ac2b19bc3609088a452dc06 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?H=C3=A5kon=20H=C3=A6gland?= Date: Mon, 10 Aug 2026 09:38:27 +0200 Subject: [PATCH 1/6] Bump GitPython to 3.1.58 to fix eighteen security advisories Fixes dependabot alerts #26-#44. Between 2026-07-21 and 2026-08-07 a series of argument-injection findings were published against GitPython, each fixed in an incremental 3.1.x release. Bumping straight to 3.1.58 closes all of them: - Unguarded git option forwarding enabling arbitrary file read, arbitrary file overwrite or command execution via clone/checkout hooks: GHSA-956x-8gvw-wg5v, GHSA-6p8h-3wgx-97gf, GHSA-fjr4-x663-mwxc, GHSA-3f7w-8rr8-f37f, GHSA-4gmw-gg2m-w46p, GHSA-9rj7-rf2p-w77r, GHSA-hh9p-6wh2-4mfc, GHSA-539m-9xh6-q6rr, GHSA-p538-c434-8v24 - Bypasses of the unsafe option denylist through option-abbreviation, joined short options and single-character token smuggling: GHSA-v396-v7q4-x2qj, GHSA-2f96-g7mh-g2hx, GHSA-r9mr-m37c-5fr3, GHSA-wvpp-8hx9-p66j - git-config name/section injection forging core.sshCommand and core.hooksPath: GHSA-3rp5-jjmw-4wv2, GHSA-jm78-9fvv-mhgr - Environment-variable exfiltration via expandvars() on clone/remote URLs: GHSA-rwj8-pgh3-r573, GHSA-94p4-4cq8-9g67 - Repository creation outside the working tree via an unvalidated .gitmodules submodule name: GHSA-hmq2-w58f-27jc GitPython is only reached here with fixed, non-attacker-controlled values: git.Repo.init() and a positional branch checkout in the test fixtures, and plain branch-name checkouts inside sphinx-versioned-docs. The new option guards therefore do not affect either call site. --- python/sphinx_docs/poetry.lock | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/python/sphinx_docs/poetry.lock b/python/sphinx_docs/poetry.lock index 8b59a42..0d2c665 100644 --- a/python/sphinx_docs/poetry.lock +++ b/python/sphinx_docs/poetry.lock @@ -287,14 +287,14 @@ smmap = ">=3.0.1,<6" [[package]] name = "gitpython" -version = "3.1.50" +version = "3.1.58" description = "GitPython is a Python library used to interact with Git repositories" optional = false python-versions = ">=3.7" groups = ["main", "dev"] files = [ - {file = "gitpython-3.1.50-py3-none-any.whl", hash = "sha256:d352abe2908d07355014abdd21ddf798c2a961469239afec4962e9da884858f9"}, - {file = "gitpython-3.1.50.tar.gz", hash = "sha256:80da2d12504d52e1f998772dc5baf6e553f8d2fcfe1fcc226c9d9a2ee3372dcc"}, + {file = "gitpython-3.1.58-py3-none-any.whl", hash = "sha256:d331e722577f0fd7fc1f857419b3ecc07af66282b933d2a4d95f84a042fdd50f"}, + {file = "gitpython-3.1.58.tar.gz", hash = "sha256:621416df10ef3fd0e19fabf9172ddeed0fa704d353d04f194eec56a625a95b22"}, ] [package.dependencies] @@ -302,7 +302,7 @@ gitdb = ">=4.0.1,<5" [package.extras] doc = ["sphinx (>=7.4.7,<8)", "sphinx-autodoc-typehints", "sphinx_rtd_theme"] -test = ["coverage[toml]", "ddt (>=1.1.1,!=1.4.3)", "mock ; python_version < \"3.8\"", "mypy (==1.18.2) ; python_version >= \"3.9\"", "pre-commit", "pytest (>=7.3.1)", "pytest-cov", "pytest-instafail", "pytest-mock", "pytest-sugar", "typing-extensions ; python_version < \"3.11\""] +test = ["basedpyright (==1.39.9) ; python_version >= \"3.9\" and sys_platform != \"cygwin\"", "coverage[toml]", "ddt (>=1.1.1,!=1.4.3)", "mock ; python_version < \"3.8\"", "mypy (==1.18.2) ; python_version >= \"3.9\"", "pre-commit", "pytest (>=7.3.1)", "pytest-cov", "pytest-instafail", "pytest-mock", "pytest-sugar", "typing-extensions ; python_version < \"3.11\""] [[package]] name = "idna" From 0b0d9450723181c60cd8a5073f61570523a41d99 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?H=C3=A5kon=20H=C3=A6gland?= Date: Mon, 10 Aug 2026 09:38:42 +0200 Subject: [PATCH 2/6] Bump setuptools to 84.0.0 to fix a security advisory Fixes dependabot alert #30: - GHSA-h35f-9h28-mq5c (CVE-2026-59890): MANIFEST.in exclusion bypass when building an sdist, through an NFC/NFD Unicode normalization collision on macOS APFS/HFS+ filesystems setuptools is a transitive runtime dependency pulled in by sphinx-versioned-docs. --- python/sphinx_docs/poetry.lock | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/python/sphinx_docs/poetry.lock b/python/sphinx_docs/poetry.lock index 0d2c665..34bf3e1 100644 --- a/python/sphinx_docs/poetry.lock +++ b/python/sphinx_docs/poetry.lock @@ -612,24 +612,24 @@ jupyter = ["ipywidgets (>=7.5.1,<9)"] [[package]] name = "setuptools" -version = "80.7.1" -description = "Easily download, build, install, upgrade, and uninstall Python packages" +version = "84.0.0" +description = "Most extensible Python build backend with support for C/C++ extension modules" optional = false -python-versions = ">=3.9" +python-versions = ">=3.10" groups = ["main"] files = [ - {file = "setuptools-80.7.1-py3-none-any.whl", hash = "sha256:ca5cc1069b85dc23070a6628e6bcecb3292acac802399c7f8edc0100619f9009"}, - {file = "setuptools-80.7.1.tar.gz", hash = "sha256:f6ffc5f0142b1bd8d0ca94ee91b30c0ca862ffd50826da1ea85258a06fd94552"}, + {file = "setuptools-84.0.0-py3-none-any.whl", hash = "sha256:51a52592b3b99e102b609654876bd65f19f999935166d1352678931132b0c670"}, + {file = "setuptools-84.0.0.tar.gz", hash = "sha256:f4695c21257f0d9b537ec2692c941d02ee143b7cc1276941349a546573b2ef73"}, ] [package.extras] -check = ["pytest-checkdocs (>=2.4)", "pytest-ruff (>=0.2.1) ; sys_platform != \"cygwin\"", "ruff (>=0.8.0) ; sys_platform != \"cygwin\""] -core = ["importlib_metadata (>=6) ; python_version < \"3.10\"", "jaraco.functools (>=4)", "jaraco.text (>=3.7)", "more_itertools", "more_itertools (>=8.8)", "packaging (>=24.2)", "platformdirs (>=4.2.2)", "tomli (>=2.0.1) ; python_version < \"3.11\"", "wheel (>=0.43.0)"] +check = ["pytest-checkdocs (>=2.14)", "pytest-ruff (>=0.2.1) ; sys_platform != \"cygwin\"", "ruff (>=0.13.0) ; sys_platform != \"cygwin\""] +core = ["importlib_metadata (>=6) ; python_version < \"3.10\"", "jaraco.functools (>=4)", "jaraco.text (>=3.7)", "more_itertools", "more_itertools (>=8.8)", "packaging (>=24.2)", "tomli (>=2.0.1) ; python_version < \"3.11\"", "wheel (>=0.43.0)"] cover = ["pytest-cov"] doc = ["furo", "jaraco.packaging (>=9.3)", "jaraco.tidelift (>=1.4)", "pygments-github-lexers (==0.0.5)", "pyproject-hooks (!=1.1)", "rst.linker (>=1.9)", "sphinx (>=3.5)", "sphinx-favicon", "sphinx-inline-tabs", "sphinx-lint", "sphinx-notfound-page (>=1,<2)", "sphinx-reredirects", "sphinxcontrib-towncrier", "towncrier (<24.7)"] -enabler = ["pytest-enabler (>=2.2)"] +enabler = ["pytest-enabler (>=3.4)"] test = ["build[virtualenv] (>=1.0.3)", "filelock (>=3.4.0)", "ini2toml[lite] (>=0.14)", "jaraco.develop (>=7.21) ; python_version >= \"3.9\" and sys_platform != \"cygwin\"", "jaraco.envs (>=2.2)", "jaraco.path (>=3.7.2)", "jaraco.test (>=5.5)", "packaging (>=24.2)", "pip (>=19.1)", "pyproject-hooks (!=1.1)", "pytest (>=6,!=8.1.*)", "pytest-home (>=0.5)", "pytest-perf ; sys_platform != \"cygwin\"", "pytest-subprocess", "pytest-timeout", "pytest-xdist (>=3)", "tomli-w (>=1.0.0)", "virtualenv (>=13.0.0)", "wheel (>=0.44.0)"] -type = ["importlib_metadata (>=7.0.2) ; python_version < \"3.10\"", "jaraco.develop (>=7.21) ; sys_platform != \"cygwin\"", "mypy (==1.14.*)", "pytest-mypy"] +type = ["importlib_metadata (>=7.0.2) ; python_version < \"3.10\"", "jaraco.develop (>=7.21) ; sys_platform != \"cygwin\"", "mypy (==1.18.*)", "pytest-mypy (>=1.0.1) ; platform_python_implementation != \"PyPy\""] [[package]] name = "smmap" From 43b033d3a41abbfbc43855ec591e100cc0ebef45 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?H=C3=A5kon=20H=C3=A6gland?= Date: Mon, 10 Aug 2026 09:38:55 +0200 Subject: [PATCH 3/6] Bump idna to 3.18 to fix a security advisory Fixes dependabot alert #25: - GHSA-65pc-fj4g-8rjx (CVE-2026-45409): specially crafted input to idna.encode() bypasses the CVE-2024-3651 fix, allowing excessive resource consumption idna is a transitive dependency of requests. --- python/sphinx_docs/poetry.lock | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/python/sphinx_docs/poetry.lock b/python/sphinx_docs/poetry.lock index 34bf3e1..cbe7565 100644 --- a/python/sphinx_docs/poetry.lock +++ b/python/sphinx_docs/poetry.lock @@ -306,16 +306,19 @@ test = ["basedpyright (==1.39.9) ; python_version >= \"3.9\" and sys_platform != [[package]] name = "idna" -version = "3.7" +version = "3.18" description = "Internationalized Domain Names in Applications (IDNA)" optional = false -python-versions = ">=3.5" +python-versions = ">=3.9" groups = ["main"] files = [ - {file = "idna-3.7-py3-none-any.whl", hash = "sha256:82fee1fc78add43492d3a1898bfa6d8a904cc97d8427f683ed8e798d07761aa0"}, - {file = "idna-3.7.tar.gz", hash = "sha256:028ff3aadf0609c1fd278d8ea3089299412a7a8b9bd005dd08b9f8285bcb5cfc"}, + {file = "idna-3.18-py3-none-any.whl", hash = "sha256:7f952cbe720b688055e3f87de14f5c3e5fdaa8bc3928985c4077ca689de849a2"}, + {file = "idna-3.18.tar.gz", hash = "sha256:ffb385a7e039654cef1ab9ef32c6fafe283c0c0467bba1d9029738ce4a14a848"}, ] +[package.extras] +all = ["mypy (>=1.11.2)", "pytest (>=8.3.2)", "ruff (>=0.6.2)"] + [[package]] name = "imagesize" version = "1.4.1" From f07fc29482946ad838b5738272e3a6ff5da0ddc0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?H=C3=A5kon=20H=C3=A6gland?= Date: Mon, 10 Aug 2026 09:39:03 +0200 Subject: [PATCH 4/6] Bump Pygments to 2.20.0 to fix a ReDoS advisory Fixes dependabot alert #16: - GHSA-5239-wwwm-4pmq (CVE-2026-4539): regular expression denial of service caused by an inefficient regex for GUID matching Pygments is a transitive dependency of Sphinx. --- python/sphinx_docs/poetry.lock | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/python/sphinx_docs/poetry.lock b/python/sphinx_docs/poetry.lock index cbe7565..a9b8d1c 100644 --- a/python/sphinx_docs/poetry.lock +++ b/python/sphinx_docs/poetry.lock @@ -517,18 +517,17 @@ testing = ["pytest", "pytest-benchmark"] [[package]] name = "pygments" -version = "2.17.2" +version = "2.20.0" description = "Pygments is a syntax highlighting package written in Python." optional = false -python-versions = ">=3.7" +python-versions = ">=3.9" groups = ["main"] files = [ - {file = "pygments-2.17.2-py3-none-any.whl", hash = "sha256:b27c2826c47d0f3219f29554824c30c5e8945175d888647acd804ddd04af846c"}, - {file = "pygments-2.17.2.tar.gz", hash = "sha256:da46cec9fd2de5be3a8a784f434e4c4ab670b4ff54d605c4c2717e9d49c4c367"}, + {file = "pygments-2.20.0-py3-none-any.whl", hash = "sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176"}, + {file = "pygments-2.20.0.tar.gz", hash = "sha256:6757cd03768053ff99f3039c1a36d6c0aa0b263438fcab17520b30a303a82b5f"}, ] [package.extras] -plugins = ["importlib-metadata ; python_version < \"3.8\""] windows-terminal = ["colorama (>=0.4.6)"] [[package]] From cc60a75200cec61603ee0e77105bacf2f1d5bd5e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?H=C3=A5kon=20H=C3=A6gland?= Date: Mon, 10 Aug 2026 09:39:11 +0200 Subject: [PATCH 5/6] Bump requests to 2.34.2 to fix a security advisory Fixes dependabot alert #15: - GHSA-gc5v-m9x4-r6x2 (CVE-2026-25645): insecure temporary file reuse in the extract_zipped_paths() utility function --- python/sphinx_docs/poetry.lock | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/python/sphinx_docs/poetry.lock b/python/sphinx_docs/poetry.lock index a9b8d1c..535c067 100644 --- a/python/sphinx_docs/poetry.lock +++ b/python/sphinx_docs/poetry.lock @@ -573,25 +573,25 @@ dev = ["pre-commit", "pytest-asyncio", "tox"] [[package]] name = "requests" -version = "2.32.4" +version = "2.34.2" description = "Python HTTP for Humans." optional = false -python-versions = ">=3.8" +python-versions = ">=3.10" groups = ["main"] files = [ - {file = "requests-2.32.4-py3-none-any.whl", hash = "sha256:27babd3cda2a6d50b30443204ee89830707d396671944c998b5975b031ac2b2c"}, - {file = "requests-2.32.4.tar.gz", hash = "sha256:27d0316682c8a29834d3264820024b62a36942083d52caf2f14c0591336d3422"}, + {file = "requests-2.34.2-py3-none-any.whl", hash = "sha256:2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0"}, + {file = "requests-2.34.2.tar.gz", hash = "sha256:f288924cae4e29463698d6d60bc6a4da69c89185ad1e0bcc4104f584e960b9ed"}, ] [package.dependencies] -certifi = ">=2017.4.17" +certifi = ">=2023.5.7" charset_normalizer = ">=2,<4" idna = ">=2.5,<4" -urllib3 = ">=1.21.1,<3" +urllib3 = ">=1.26,<3" [package.extras] socks = ["PySocks (>=1.5.6,!=1.5.7)"] -use-chardet-on-py3 = ["chardet (>=3.0.2,<6)"] +use-chardet-on-py3 = ["chardet (>=3.0.2,<8)"] [[package]] name = "rich" From dabb13c2e60ad7d268d4d9feb28e69987c92433b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?H=C3=A5kon=20H=C3=A6gland?= Date: Mon, 10 Aug 2026 09:39:21 +0200 Subject: [PATCH 6/6] Bump pytest to 9.1.1 to fix a tmpdir security advisory Fixes dependabot alert #17: - GHSA-6w46-j5rx-g56g (CVE-2025-71176): insecure handling of the per-user temporary directory, which is reused across runs and can be pre-created by another local user The fix first landed in pytest 9.0.3, so the dev constraint has to move from ^8.3.4 to ^9.0.3. pytest-mock 3.14.0 requires only pytest >= 6.2.5 and is unaffected. --- python/sphinx_docs/poetry.lock | 23 ++++++++++++----------- python/sphinx_docs/pyproject.toml | 2 +- 2 files changed, 13 insertions(+), 12 deletions(-) diff --git a/python/sphinx_docs/poetry.lock b/python/sphinx_docs/poetry.lock index 535c067..a486970 100644 --- a/python/sphinx_docs/poetry.lock +++ b/python/sphinx_docs/poetry.lock @@ -521,7 +521,7 @@ version = "2.20.0" description = "Pygments is a syntax highlighting package written in Python." optional = false python-versions = ">=3.9" -groups = ["main"] +groups = ["main", "dev"] files = [ {file = "pygments-2.20.0-py3-none-any.whl", hash = "sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176"}, {file = "pygments-2.20.0.tar.gz", hash = "sha256:6757cd03768053ff99f3039c1a36d6c0aa0b263438fcab17520b30a303a82b5f"}, @@ -532,26 +532,27 @@ windows-terminal = ["colorama (>=0.4.6)"] [[package]] name = "pytest" -version = "8.3.4" +version = "9.1.1" description = "pytest: simple powerful testing with Python" optional = false -python-versions = ">=3.8" +python-versions = ">=3.10" groups = ["dev"] files = [ - {file = "pytest-8.3.4-py3-none-any.whl", hash = "sha256:50e16d954148559c9a74109af1eaf0c945ba2d8f30f0a3d3335edde19788b6f6"}, - {file = "pytest-8.3.4.tar.gz", hash = "sha256:965370d062bce11e73868e0335abac31b4d3de0e82f4007408d242b4f8610761"}, + {file = "pytest-9.1.1-py3-none-any.whl", hash = "sha256:37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c"}, + {file = "pytest-9.1.1.tar.gz", hash = "sha256:1088fbde8f2b49d95a549a195707afa7a76a3ce9bcadc26b6d71f0ffda5fe313"}, ] [package.dependencies] -colorama = {version = "*", markers = "sys_platform == \"win32\""} -exceptiongroup = {version = ">=1.0.0rc8", markers = "python_version < \"3.11\""} -iniconfig = "*" -packaging = "*" +colorama = {version = ">=0.4", markers = "sys_platform == \"win32\""} +exceptiongroup = {version = ">=1", markers = "python_version < \"3.11\""} +iniconfig = ">=1.0.1" +packaging = ">=22" pluggy = ">=1.5,<2" +pygments = ">=2.7.2" tomli = {version = ">=1", markers = "python_version < \"3.11\""} [package.extras] -dev = ["argcomplete", "attrs (>=19.2)", "hypothesis (>=3.56)", "mock", "pygments (>=2.7.2)", "requests", "setuptools", "xmlschema"] +dev = ["argcomplete", "attrs (>=19.2)", "hypothesis (>=3.56)", "mock", "requests", "setuptools", "xmlschema"] [[package]] name = "pytest-mock" @@ -966,4 +967,4 @@ dev = ["black (>=19.3b0) ; python_version >= \"3.6\"", "pytest (>=4.6.2)"] [metadata] lock-version = "2.1" python-versions = "^3.10" -content-hash = "f7865b67eb3ce6dc6210c3fb44094c316106f5be7b7c04130b5eee750befaa7a" +content-hash = "3f10c5fb6f92fadb3e8c0d8c9037530531d624072dd416c0b33f9aec8264f66d" diff --git a/python/sphinx_docs/pyproject.toml b/python/sphinx_docs/pyproject.toml index 2dc9ecb..4bcdad3 100644 --- a/python/sphinx_docs/pyproject.toml +++ b/python/sphinx_docs/pyproject.toml @@ -22,7 +22,7 @@ opmdoc-download-files = "opm_python_docs.download_files:main" opmdoc-view-doc = "opm_python_docs.view_docs:main" [tool.poetry.group.dev.dependencies] -pytest = "^8.3.4" +pytest = "^9.0.3" pytest-mock = "^3.14.0" gitpython = "^3.1.44" coverage = "^7.6.10"