maziggy 9d440beb80 chore(security): bump idna >=3.15 (CVE-2026-45409) + ignore disputed PyJWT advisory ...

- requirements.txt: pin idna>=3.15 to clear ReDoS in idna.encode() on
    crafted Unicode payloads. Transitive via anyio/httpx/requests/yarl,
    so the explicit floor stops a future downstream loosening from
    silently downgrading us.
  - security.yml: permanently --ignore-vuln CVE-2025-45768 (PyJWT). The
    advisory is disputed by the maintainers — "key length is chosen by
    the application" — and no fix version exists. Bambuddy is safe:
    auto-generates secrets via secrets.token_urlsafe(64) and rejects
    file-loaded secrets shorter than 32 chars (auth.py:177, :184).
  - security.yml: drop the stale Pygments --ignore-vuln CVE-2026-4539.
    Pygments has been patched upstream; the ignore no longer matches
    anything.

2026-05-20 12:36:32 +02:00

..

ci.yml

Updated .github/workflows/ci.yml

2026-04-12 15:05:28 +02:00

cleanup-ghcr.yml

Updated .github/workflows/cleanup-ghcr.yml

2026-05-01 11:49:46 +02:00

codeql.yml

Add CodeQL advanced setup workflow with accepted-risk exclusions

2026-02-06 13:25:23 +01:00

issue-closed.yml

Updated CI

2026-01-29 13:31:07 +01:00

repo-stats.yml

Updated CI

2026-04-07 17:16:48 +02:00

security.yml

chore(security): bump idna >=3.15 (CVE-2026-45409) + ignore disputed PyJWT advisory

2026-05-20 12:36:32 +02:00

stale.yml

The only-labels: 'feedback' parameter tells the stale bot to only process issues that have the feedback label. All other issues (feature requests with future, bug

2026-02-16 08:35:43 +01:00