Skip to content
Security

deps: bump multidict from 6.8.0 to 6.9.1 #146

Sign in to view logs

deps: bump multidict from 6.8.0 to 6.9.1

deps: bump multidict from 6.8.0 to 6.9.1 #146

Triggered via pull request October 30, 2026 18:49
@dependabotdependabot[bot]
synchronize #161
dependabot/uv/multidict-6.9.1
Status Failure
Total duration 59s
Artifacts 1

security.yml

on: pull_request
Dependency Audit
43s
Dependency Audit
Dependency Review
6s
Dependency Review
Audit Script Tests
13s
Audit Script Tests
Workflow Hardening
39s
Workflow Hardening
Post Audit Comment
9s
Post Audit Comment
Notify Slack
Notify Slack
Fit to window
Zoom out
Zoom in

Annotations

8 errors
Dependency Audit
Process completed with exit code 1.
Dependency audit failed
Fixable HIGH/CRITICAL advisories are present. See the job summary for the full report and the required version bumps.
HIGH: CVE-2026-112940 in filelock
filelock 4.1.0 -- fixed in 4.2.1. filelock: filelock: Arbitrary file overwrite via insecure database file reopening
HIGH: CVE-2026-114605 in dnspython
dnspython 2.8.0 -- fixed in 2.9.0. dnspython: dnspython: Denial of Service via excessive DNS compression pointer traversal
HIGH: GHSA-2g87-pp6c-29x5 in aiohttp
aiohttp 3.14.3 -- fixed in 3.14.4. aiohttp: Multiple instances of excessive or unbounded memory/CPU use
HIGH: CVE-2026-111066 in aiohttp
aiohttp 3.14.3 -- fixed in 3.14.4. aiohttp: aiohttp: Denial of Service via file descriptor exhaustion in multipart request processing
HIGH: CVE-2026-111064 in aiohttp
aiohttp 3.14.3 -- fixed in 3.14.4. aiohttp: aiohttp: Denial of Service via missing initial request timeout
CRITICAL: GHSA-hq85-5cpj-mr62 in uv
uv 0.12.17 -- fixed in 0.13.4. uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised

Artifacts

Produced during runtime
Name Size Digest
dependency-audit
175 KB
sha256:fcdaed48035d39a9e5be62b6b8938739d64e729dab1630bfaeffd918461ae4dd