What the developer wrote
Authored by M1nd3r
chore(deps): update mako to 1.3.12
- Updated mako from 1.3.10 to 1.3.12
- Rational: Suppresses potential flagging of trezor-firmware as unsafe, as mako versions <=1.3.11 have a vulnerability (in code we are not using). See: https://github.com/trezor/trezor-firmware/security/dependabot/125
[no changelog]
What changed, and why it matters
This is a routine dependency update bumping the Python Mako templating library from version 1.3.10 to 1.3.12. The commit message says the change is meant to avoid false safety warnings, because Mako versions 1.3.11 and earlier have a known vulnerability in code that Trezor firmware does not actually use. Only the lock file (uv.lock) changed; no Trezor source code was modified.
No urgent action is required for end users. The update is a defensive hygiene measure. Reviewers may want to confirm that Mako is only used in build/tooling contexts and that untrusted templates are not rendered in production code paths.
Security signals we found
Dependency version bump for a known-vulnerable package
Commit message references a GitHub Dependabot security alert
Vendor states the vulnerable Mako code is not used by the project
No Trezor firmware source code changed
Evidence from the diff
The commit updates a single pinned dependency entry in uv.lock for the Mako package. Mako 1.3.11 and earlier are affected by a security issue (likely CVE-2025-XXXX or a similar Mako sandbox escape / code injection flaw), but the commit explicitly notes the vulnerable code path is not used by trezor-firmware. The patch is therefore a proactive hygiene update rather than a fix for an exploitable condition in the project itself.
Changed components
uv.lock dependency manifestPython build/tooling dependency: makoInspect captured patch +3 / −3
diff --git a/uv.lock b/uv.lock
index fd698fce..2028049d 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1071,14 +1071,14 @@ wheels = [
[[package]]
name = "mako"
-version = "1.3.10"
+version = "1.3.12"
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "markupsafe" },
]
-sdist = { url = "https://files.pythonhosted.org/packages/9e/38/bd5b78a920a64d708fe6bc8e0a2c075e1389d53bef8413725c63ba041535/mako-1.3.10.tar.gz", hash = "sha256:99579a6f39583fa7e5630a28c3c1f440e4e97a414b80372649c0ce338da2ea28", size = 392474, upload-time = "2025-04-10T12:44:31.16Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/00/62/791b31e69ae182791ec67f04850f2f062716bbd205483d63a215f3e062d3/mako-1.3.12.tar.gz", hash = "sha256:9f778e93289bd410bb35daadeb4fc66d95a746f0b75777b942088b7fd7af550a", size = 400219, upload-time = "2026-04-28T19:01:08.512Z" }
wheels = [
- { url = "https://files.pythonhosted.org/packages/87/fb/99f81ac72ae23375f22b7afdb7642aba97c00a713c217124420147681a2f/mako-1.3.10-py3-none-any.whl", hash = "sha256:baef24a52fc4fc514a0887ac600f9f1cff3d82c61d4d700a1fa84d597b88db59", size = 78509, upload-time = "2025-04-10T12:50:53.297Z" },
+ { url = "https://files.pythonhosted.org/packages/bc/b1/a0ec7a5a9db730a08daef1fdfb8090435b82465abbf758a596f0ea88727e/mako-1.3.12-py3-none-any.whl", hash = "sha256:8f61569480282dbf557145ce441e4ba888be453c30989f879f0d652e39f53ea9", size = 78521, upload-time = "2026-04-28T19:01:10.393Z" },
]
[[package]]
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.