Out-of-date `click` dependency has an attached CVE
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 74/100
Research direction
Start by inspecting the click dependency constraint in pyproject.toml and run uv audit to reproduce the reported vulnerability. Check the project's dependency and test setup for compatibility with click 8.3.3; done means the constraint permits the fixed version, tests pass, and uv audit no longer reports this vulnerability.
Written by the indexing model from the issue text.
Description
Running uv audit on my project which uses fixit as a direct dependency gives the following warning for click as a transative dependency:
Vulnerabilities:
click 8.1.8 has 1 known vulnerability:
- PYSEC-2026-2132: No summary provided
Fixed in: 8.3.3
Advisory information: https://access.redhat.com/errata/RHSA-2026:24761
In Fixit's pyproject.toml, click has a dependency marker of click>=8.0,<8.2. Is there any reason why this cannot be upgraded to click>=8.3.3?
- Dominant language
- Python
- Stars
- 714
- Forks
- 72
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from Instagram/Fixit
-
Difficulty 4/5 3-5 days Newbie friendliness 42/100
-
enhancement
Difficulty 3/5 1-2 days Newbie friendliness 35/100
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
-
Difficulty 4/5 3-5 days Newbie friendliness 25/100
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100