build(deps): 升级依赖修复 59 条 Dependabot 安全警报 - #125
Merged
Merged
Conversation
…t 安全警报 - aiohttp 3.12.15 -> 3.14.3（32 条，含 HTTP 解析器越界读 CVE-2026-69244） - anyio 4.10.0 -> 4.15.1（1 critical TLS 证书伪造 CVE-2026-63374） - pillow 11.3.0 -> 12.3.0（18 条，仅 dev 组） - starlette 0.47.3 -> 1.6.0（6 条，需 fastapi >=0.141.1 解除上限） - idna 3.10 -> 3.20（1 条） - fastapi 0.116.1 -> 0.141.1（pyproject 约束同步放宽） pytest 40 passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
背景
Dependabot 报告 master 分支存在 59 条开放警报（1 critical / 18 high / 25 moderate / 15 low），全部来自
poetry.lock。本 PR 一次性修复全部警报。升级内容
pyproject.toml约束>=0.141.1,<0.142.0，为 starlette 1.x 升级的前提其余依赖（含 discord.py 2.7.1、sqlalchemy、nuitka 等）未受牵连，锁定版本不变。
验证
pytest：40 passed（Python 3.12.14）network/全部子模块（v11/v12 的 http、ws、ws_reverse、http_post、http_webhook）与utils/、call_action导入冒烟通过poetry check锁文件一致性通过