Skip to content

fix: upgrade click to 8.3.3 - #260

Merged
phantom-jacob merged 1 commit into
mainfrom
vuln-89451-click-upgrade
Sep 1, 2026
Merged

phantom-jacob merged 1 commit into
mainfrom
vuln-89451-click-upgrade

Conversation

@athreya-splunk

Copy link
Copy Markdown
Contributor

Summary

  • add a uv constraint requiring click>=8.3.3
  • regenerate uv.lock so click resolves to 8.3.3
  • retain the SDK-supported click range from splunk-soar-sdk 4.1.2

Ticket

Verification

  • uv lock --check
  • uv sync
  • verified runtime versions: click 8.3.3, typer 0.17.4
  • pre-commit checks passed on the commit

@bb-splunk bb-splunk left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved, but why not bump to latest 8.5.0?

@phantom-jacob
phantom-jacob merged commit ed8965b into main Sep 1, 2026
4 checks passed
@phantom-jacob
phantom-jacob deleted the vuln-89451-click-upgrade branch September 1, 2026 13:07
@athreya-splunk

Copy link
Copy Markdown
Contributor Author

Approved, but why not bump to latest 8.5.0?

@bb-splunk - click is only used here transitively via splunk-soar-sdk, whose latest release (4.1.2) caps it at <8.4.0, so 8.3.3 is the remediated version for VULN that still resolves.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants