immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-07-25 14:00:45 +03:00
Code Issues 783 Packages Projects Releases 22 Wiki Activity

[PR #7438] [MERGED] fix(deps): update dependency orjson to v3.9.15 [security] #11623

New Issue
Closed
opened 2026-02-05 14:42:54 +03:00 by OVERLORD · 0 comments
OVERLORD commented 2026-02-05 14:42:54 +03:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/immich-app/immich/pull/7438
Author: @renovate[bot]
Created: 2/27/2024
Status: ✅ Merged
Merged: 2/27/2024
Merged by: @mertalev

Base: main ← Head: renovate/pypi-orjson-vulnerability

📝 Commits (1)

  • 2f1a65f fix(deps): update dependency orjson to v3.9.15 [security]

📊 Changes

1 file changed (+51 additions, -51 deletions)

View changed files

📝 machine-learning/poetry.lock (+51 -51)

📄 Description

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
orjson (changelog) 3.9.14 -> 3.9.15 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2024-27454

orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents.

Release Notes

ijl/orjson (orjson)

v3.9.15

Compare Source

Fixed
  • Implement recursion limit of 1024 on orjson.loads().
  • Use byte-exact read on str formatting SIMD path to avoid crash.

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/immich-app/immich/pull/7438 **Author:** [@renovate[bot]](https://github.com/apps/renovate) **Created:** 2/27/2024 **Status:** ✅ Merged **Merged:** 2/27/2024 **Merged by:** [@mertalev](https://github.com/mertalev) **Base:** `main` ← **Head:** `renovate/pypi-orjson-vulnerability` --- ### 📝 Commits (1) - [`2f1a65f`](https://github.com/immich-app/immich/commit/2f1a65f13fa1fb6a4d9fcaaf00ad2af32898c316) fix(deps): update dependency orjson to v3.9.15 [security] ### 📊 Changes **1 file changed** (+51 additions, -51 deletions) <details> <summary>View changed files</summary> 📝 `machine-learning/poetry.lock` (+51 -51) </details> ### 📄 Description [![Mend Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [orjson](https://togithub.com/ijl/orjson) ([changelog](https://togithub.com/ijl/orjson/blob/master/CHANGELOG.md)) | `3.9.14` -> `3.9.15` | [![age](https://developer.mend.io/api/mc/badges/age/pypi/orjson/3.9.15?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://developer.mend.io/api/mc/badges/adoption/pypi/orjson/3.9.15?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://developer.mend.io/api/mc/badges/compatibility/pypi/orjson/3.9.14/3.9.15?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/orjson/3.9.14/3.9.15?slim=true)](https://docs.renovatebot.com/merge-confidence/) | ### GitHub Vulnerability Alerts #### [CVE-2024-27454](https://nvd.nist.gov/vuln/detail/CVE-2024-27454) orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents. --- ### Release Notes <details> <summary>ijl/orjson (orjson)</summary> ### [`v3.9.15`](https://togithub.com/ijl/orjson/blob/HEAD/CHANGELOG.md#3915---2024-02-23) [Compare Source](https://togithub.com/ijl/orjson/compare/3.9.14...3.9.15) ##### Fixed - Implement recursion limit of 1024 on `orjson.loads()`. - Use byte-exact read on `str` formatting SIMD path to avoid crash. </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/immich-app/immich). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4yMTIuMCIsInVwZGF0ZWRJblZlciI6IjM3LjIxMi4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9--> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
OVERLORD added the pull-request label 2026-02-05 14:42:54 +03:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:skip
changelog:translation
cli
date-time
dependencies
documentation
external-library
format
good first issue
mobile-beta
mobile-beta
mobile-beta
needs-answer
nice to have
pull-request
Mirrored from GitHub Pull Request
 sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#11623
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?