bambuddy

mirror of https://github.com/maziggy/bambuddy.git synced 2026-09-30 11:12:35 +02:00

Files

T

maziggy fdd20e49b3 chore(security): bump idna >=3.15 (CVE-2026-45409) + ignore disputed PyJWT advisory

- requirements.txt: pin idna>=3.15 to clear ReDoS in idna.encode() on
    crafted Unicode payloads. Transitive via anyio/httpx/requests/yarl,
    so the explicit floor stops a future downstream loosening from
    silently downgrading us.
  - security.yml: permanently --ignore-vuln CVE-2025-45768 (PyJWT). The
    advisory is disputed by the maintainers — "key length is chosen by
    the application" — and no fix version exists. Bambuddy is safe:
    auto-generates secrets via secrets.token_urlsafe(64) and rejects
    file-loaded secrets shorter than 32 chars (auth.py:177, :184).
  - security.yml: drop the stale Pygments --ignore-vuln CVE-2026-4539.
    Pygments has been patched upstream; the ignore no longer matches
    anything.

2026-05-20 12:56:22 +02:00

ci.yml

Updated .github/workflows/ci.yml

2026-04-12 15:05:28 +02:00

cleanup-ghcr.yml

Updated .github/workflows/cleanup-ghcr.yml

2026-05-01 11:49:46 +02:00

codeql.yml

Add CodeQL advanced setup workflow with accepted-risk exclusions

2026-02-06 13:25:23 +01:00

issue-closed.yml

Updated CI