[Snyk] Fix for 3 vulnerabilities by dominicusin · Pull Request #2 · dominicusin/package-maximizer

dominicusin · 2025-12-14T09:28:58Z

Snyk has created this PR to fix 3 vulnerabilities in the pip dependencies of this project.

Snyk changed the following file(s):

requirements.txt

⚠️

Warning

equests 2.31.0 requires urllib3, which is not installed.
matplotlib 3.5.3 requires fonttools, which is not installed.
flake8 5.0.4 has requirement importlib-metadata<4.3,>=1.1.0; python_version < "3.8", but you have importlib-metadata 6.7.0.

Important

Check the changes in this PR to ensure they won't cause issues with your project.
Max score is 1000. Note that the real score may have changed since the PR was raised.
This PR was automatically created by Snyk using the credentials of a real user.
Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the affected dependencies could be upgraded.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 XML Injection
🦉 Allocation of Resources Without Limits or Throttling

The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-FONTTOOLS-14151621 - https://snyk.io/vuln/SNYK-PYTHON-URLLIB3-14192442 - https://snyk.io/vuln/SNYK-PYTHON-URLLIB3-14192443

coderabbitai · 2025-12-14T09:29:09Z

Important

Review skipped

Ignore keyword(s) in the title.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch snyk-fix-6de793ad5af632a7133b1fb5b52dc45c

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

qodo-code-review · 2025-12-14T09:29:31Z

CI Feedback 🧐

A test triggered by this PR failed. Here is an AI-generated analysis of the failure:

Action: test (ubuntu-latest, 3.9)
Failed stage: Install Python dependencies [❌]
Failure summary: The action failed during dependency installation because the requirement `fonttools>=4.61.0` could not be satisfied under Python 3.9. - Pip reported that all `fonttools` versions >=4.61.0 require Python >=3.10, and thus are incompatible with the runner’s Python version (cp39). - Error lines: - `ERROR:` `Could not find a version that satisfies the requirement fonttools>=4.61.0` - `ERROR: No matching` `distribution found for fonttools>=4.61.0` - Root cause: requirements.txt pins `fonttools>=4.61.0` but the CI uses Python 3.9. Upgrade the CI Python version to >=3.10 or relax the `fonttools` requirement to a version compatible with Python 3.9 (<=4.60.x).
Relevant error logs: 1: ##[group]Runner Image Provisioner 2: Hosted Compute Agent ... 286: Downloading requests-2.32.5-py3-none-any.whl.metadata (4.9 kB) 287: Collecting lxml>=4.6.0 (from -r requirements.txt (line 21)) 288: Downloading lxml-6.0.2-cp39-cp39-manylinux_2_26_x86_64.manylinux_2_28_x86_64.whl.metadata (3.6 kB) 289: Collecting beautifulsoup4>=4.9.0 (from -r requirements.txt (line 22)) 290: Downloading beautifulsoup4-4.14.3-py3-none-any.whl.metadata (3.8 kB) 291: Collecting pytest>=6.2.0 (from -r requirements.txt (line 25)) 292: Downloading pytest-8.4.2-py3-none-any.whl.metadata (7.7 kB) 293: Collecting pytest-cov>=3.0.0 (from -r requirements.txt (line 26)) 294: Downloading pytest_cov-7.0.0-py3-none-any.whl.metadata (31 kB) 295: Collecting black>=21.0.0 (from -r requirements.txt (line 29)) 296: Downloading black-25.11.0-cp39-cp39-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl.metadata (85 kB) 297: Collecting flake8>=4.0.0 (from -r requirements.txt (line 30)) 298: Downloading flake8-7.3.0-py2.py3-none-any.whl.metadata (3.8 kB) 299: Collecting mypy>=0.910 (from -r requirements.txt (line 31)) 300: Downloading mypy-1.19.0-cp39-cp39-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl.metadata (2.2 kB) 301: ERROR: Ignored the following yanked versions: 4.39.1, 4.44.1 302: ERROR: Ignored the following versions that require a different python version: 2.1.0 Requires-Python >=3.10; 2.1.1 Requires-Python >=3.10; 2.1.2 Requires-Python >=3.10; 2.1.3 Requires-Python >=3.10; 2.2.0 Requires-Python >=3.10; 2.2.1 Requires-Python >=3.10; 2.2.2 Requires-Python >=3.10; 2.2.3 Requires-Python >=3.10; 2.2.4 Requires-Python >=3.10; 2.2.5 Requires-Python >=3.10; 2.2.6 Requires-Python >=3.10; 2.3.0 Requires-Python >=3.11; 2.3.1 Requires-Python >=3.11; 2.3.2 Requires-Python >=3.11; 2.3.3 Requires-Python >=3.11; 2.3.4 Requires-Python >=3.11; 2.3.5 Requires-Python >=3.11; 2.4.0rc1 Requires-Python >=3.11; 25.12.0 Requires-Python >=3.10; 26.1a1 Requires-Python >=3.10; 3.0.0rc0 Requires-Python >=3.11; 3.10.0 Requires-Python >=3.10; 3.10.0rc1 Requires-Python >=3.10; 3.10.1 Requires-Python >=3.10; 3.10.3 Requires-Python >=3.10; 3.10.5 Requires-Python >=3.10; 3.10.6 Requires-Python >=3.10; 3.10.7 Requires-Python >=3.10; 3.10.8 Requires-Python >=3.10; 4.61.0 Requires-Python >=3.10; 4.61.1 Requires-Python >=3.10; 8.2.0 Requires-Python >=3.10; 8.2.1 Requires-Python >=3.10; 8.2.2 Requires-Python >=3.10; 8.3.0 Requires-Python >=3.10; 8.3.1 Requires-Python >=3.10; 9.0.0 Requires-Python >=3.10; 9.0.1 Requires-Python >=3.10; 9.0.2 Requires-Python >=3.10 303: ERROR: Could not find a version that satisfies the requirement fonttools>=4.61.0 (from versions: 2.3, 2.4, 2.5, 3.0, 3.1.0, 3.1.1, 3.1.2, 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.3.0, 3.3.1, 3.4.0, 3.5.0, 3.6.0, 3.6.1, 3.6.2, 3.6.3, 3.7.0, 3.7.1, 3.7.2, 3.8.0, 3.9.0, 3.9.1, 3.9.2, 3.10.0, 3.11.0, 3.12.0, 3.12.1, 3.13.0, 3.13.1, 3.14.0, 3.15.0, 3.15.1, 3.16.0, 3.17.0, 3.18.0, 3.19.0, 3.20.0, 3.20.1, 3.21.0, 3.21.1, 3.21.2, 3.22.0, 3.23.0, 3.24.0, 3.24.1, 3.24.2, 3.25.0, 3.26.0, 3.27.0, 3.27.1, 3.28.0, 3.29.0, 3.29.1, 3.30.0, 3.31.0, 3.32.0, 3.33.0, 3.34.0, 3.34.1, 3.34.2, 3.35.0, 3.35.1, 3.35.2, 3.36.0, 3.37.0, 3.37.1, 3.37.2, 3.37.3, 3.38.0, 3.39.0, 3.40.0, 3.41.0, 3.41.1, 3.41.2, 3.42.0, 3.43.0, 3.43.1, 3.43.2, 3.44.0, 4.0.0, 4.0.1, 4.0.2, 4.1.0, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.2.4, 4.2.5, 4.3.0, 4.4.0, 4.4.1, 4.4.2.dev0, 4.4.2, 4.4.3, 4.5.0, 4.6.0, 4.7.0, 4.8.0, 4.8.1, 4.9.0, 4.10.0, 4.10.1, 4.10.2, 4.11.0, 4.12.0, 4.12.1, 4.13.0, 4.14.0, 4.15.0, 4.16.0, 4.16.1, 4.17.0, 4.17.1, 4.18.0, 4.18.1, 4.18.2, 4.19.0, 4.19.1, 4.20.0, 4.21.0, 4.21.1, 4.22.0, 4.22.1, 4.23.0, 4.23.1, 4.24.0, 4.24.1, 4.24.2, 4.24.3, 4.24.4, 4.25.0, 4.25.1, 4.25.2, 4.26.0, 4.26.1, 4.26.2, 4.27.0, 4.27.1, 4.28.0, 4.28.1, 4.28.2, 4.28.3, 4.28.4, 4.28.5, 4.29.0, 4.29.1, 4.30.0, 4.31.0, 4.31.1, 4.31.2, 4.32.0, 4.33.0, 4.33.1, 4.33.2, 4.33.3, 4.34.0, 4.34.1, 4.34.2, 4.34.3, 4.34.4, 4.35.0, 4.36.0, 4.37.0, 4.37.1, 4.37.2, 4.37.3, 4.37.4, 4.38.0, 4.38.1.dev0, 4.39.0, 4.39.2, 4.39.3, 4.39.4, 4.40.0, 4.41.0, 4.41.1, 4.42.0, 4.42.1, 4.43.0, 4.43.1, 4.44.0, 4.44.3, 4.45.0, 4.45.1, 4.46.0, 4.47.0, 4.47.2, 4.48.1, 4.49.0, 4.50.0, 4.51.0, 4.52.1, 4.52.3, 4.52.4, 4.53.0, 4.53.1, 4.54.0, 4.54.1, 4.55.0, 4.55.1, 4.55.2, 4.55.3, 4.55.4, 4.55.5, 4.55.6, 4.55.7, 4.55.8, 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.58.2, 4.58.3, 4.58.4, 4.58.5, 4.59.0, 4.59.1, 4.59.2, 4.60.0, 4.60.1, 4.60.2) 304: ERROR: No matching distribution found for fonttools>=4.61.0 305: ##[error]Process completed with exit code 1. 306: Post job cleanup.

fix: requirements.txt to reduce vulnerabilities

8ada3ed

The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-FONTTOOLS-14151621 - https://snyk.io/vuln/SNYK-PYTHON-URLLIB3-14192442 - https://snyk.io/vuln/SNYK-PYTHON-URLLIB3-14192443

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Fix for 3 vulnerabilities#2

[Snyk] Fix for 3 vulnerabilities#2
dominicusin wants to merge 1 commit intomainfrom
snyk-fix-6de793ad5af632a7133b1fb5b52dc45c

dominicusin commented Dec 14, 2025

Uh oh!

coderabbitai bot commented Dec 14, 2025

Review skipped

Uh oh!

qodo-code-review bot commented Dec 14, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dominicusin commented Dec 14, 2025

Snyk has created this PR to fix 3 vulnerabilities in the pip dependencies of this project.

Snyk changed the following file(s):

Uh oh!

coderabbitai bot commented Dec 14, 2025

Review skipped

Uh oh!

qodo-code-review bot commented Dec 14, 2025

CI Feedback 🧐

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants