FreeOnePlus opened a new pull request, #217: URL: https://github.com/apache/doris-mcp-server/pull/217
## Summary - update the locked Marshmallow transitive dependency from 4.0.0 to 4.1.2 to address CVE-2025-68480 - update the locked Virtualenv transitive dependency from 20.31.2 to 20.36.1 to include the symlink-based TOCTOU hardening - document both security-related dependency updates under Unreleased - supersede Dependabot PRs #215 and #216 with one reviewed lockfile change ## Validation - uv lock --check - uv sync --locked --all-groups - ruff check . - mypy doris_mcp_server - bandit -q -c pyproject.toml -r doris_mcp_server - python generate_tool_catalog.py --check - pytest -q -W error: 1859 passed, 85 skipped, 68.11% coverage - built sdist and wheel successfully - inspected release archives for excluded ledger, audit-report, and environment files - installed the wheel into a clean Python 3.12 environment and verified package and CLI version 1.0.0 No runtime code or direct dependency constraint was changed. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
