You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Trivy's advisory database picked up 41 further findings against the lockfile, 20 of them high, on packages already pinned here rather than anything the last bump moved. The serious ones are two PyJWT bypasses, one accepting forged tokens and one on verifier-side algorithm selection, Starlette SSRF and NTLM credential theft through UNC paths, and the MCP SDK serving session requests without verifying them. This raises the fifteen packages that have a published fix. WeasyPrint's CSS injection and the ecdsa Minerva timing attack have none and stay.
Starlette needs 1.3.1 and resolution landed on 1.6.0, which carries FastAPI from 0.128.1 to 0.141.1, and NiceGUI needs 3.12.0 and landed on 3.16.0. Those two are the reason this touches code at all, in a second commit kept apart from the lockfile.
NiceGUI now imports the members of its ui module lazily, which broke two tests that neutralised the dynamic page import by replacing importlib.import_module process-wide with a single-argument stub, since NiceGUI's own lazy lookups then hit that stub. The replacement is scoped to the one module name that is actually imported and delegates everything else to the real function, so it no longer depends on patch ordering. Separately, Dialog.close() became fluent and returns the dialog, so render_dialog_actions stopped accepting a plain close callback as on_cancel. It hands that callback straight to a button and discards the result, so the parameter was always typed more narrowly than its use and is now widened rather than wrapped at five call sites.
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR successfully upgrades 15 vulnerable dependencies and adapts the codebase to accommodate breaking changes in NiceGUI and Starlette. The analysis shows the changes are up to standards. However, the implementation of the new fluent dialog API in render_dialog_actions lacks a corresponding unit test to verify it handles objects returned by callbacks. No major security flaws or logic bugs were found in the current changes.
Test suggestions
Verify render_dialog_actions accepts a callback returning a Dialog object without type errors or runtime failures.
Verify test_web_app_factory can isolate page imports without blocking NiceGUI's internal lazy-loaded imports.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify render_dialog_actions accepts a callback returning a Dialog object without type errors or runtime failures.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
Trivy's advisory database picked up 41 further findings against the lockfile, 20 of them high, on packages already pinned here rather than anything the last bump moved. The serious ones are two PyJWT bypasses, one accepting forged tokens and one on verifier-side algorithm selection, Starlette SSRF and NTLM credential theft through UNC paths, and the MCP SDK serving session requests without verifying them. This raises the fifteen packages that have a published fix. WeasyPrint's CSS injection and the ecdsa Minerva timing attack have none and stay.
Starlette needs 1.3.1 and resolution landed on 1.6.0, which carries FastAPI from 0.128.1 to 0.141.1, and NiceGUI needs 3.12.0 and landed on 3.16.0. Those two are the reason this touches code at all, in a second commit kept apart from the lockfile.
NiceGUI now imports the members of its ui module lazily, which broke two tests that neutralised the dynamic page import by replacing importlib.import_module process-wide with a single-argument stub, since NiceGUI's own lazy lookups then hit that stub. The replacement is scoped to the one module name that is actually imported and delegates everything else to the real function, so it no longer depends on patch ordering. Separately, Dialog.close() became fluent and returns the dialog, so render_dialog_actions stopped accepting a plain close callback as on_cancel. It hands that callback straight to a button and discards the result, so the parameter was always typed more narrowly than its use and is now widened rather than wrapped at five call sites.