rayhan 4fea32cef1 fix: remediate CVE-2026-26209 by constraining cbor2 to >=5.9.0 (#17903) ...

## Summary
  
Remediates CVE-2026-26209 (HIGH) in `cbor2` by adding `cbor2>=5.9.0` to
`constraint-dependencies` in `pyproject.toml`.
  
  | CVE | Severity | Package | Installed | Fixed in |
  |---|---|---|---|---|
  | CVE-2026-26209 | HIGH | cbor2 | 5.8.0 | 5.9.0 |
  
`cbor2` is a transitive dependency pulled in by `ranx` with no version
constraint, stuck at 5.8.0 because lockfile hadn't been re-resolved.

2026-08-06 10:27:10 +08:00

836 KiB

Raw Blame History

View Raw