What the developer wrote
Authored by Roman Zeyde
chore: update uv.lock
[no changelog]
What changed, and why it matters
This is a routine lock-file update for a Python dependency manager. It records that an internal Trezor package named 'tvl' now depends on two additional libraries ('cffi' and 'libcst'). There is no indication of a security fix, vulnerability, or malicious change in the commit itself.
No security action required. Treat as normal maintenance. If reviewing supply-chain risk, verify the intended purpose of the newly added 'cffi' and 'libcst' dependencies in the tvl package, but this commit alone does not introduce a vulnerability.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit updates ‘uv.lock’, the frozen dependency graph for the ‘uv’ Python package manager. The only material change visible is that the editable package ‘tvl’ (sourced from vendor/ts-tvl) declares two new dependencies: ‘cffi’ and ‘libcst’, with Python-version-specific version constraints. No source code is modified, no CVE is referenced, and no security relevance is stated.
Changed components
uv.lockvendor/ts-tvl (tvl package)Inspect captured patch +7 / −1
diff --git a/uv.lock b/uv.lock
index bb2430b4..12f8131a 100644
--- a/uv.lock
+++ b/uv.lock
@@ -2406,13 +2406,15 @@ requires-dist = [
[[package]]
name = "tvl"
-version = "2.3"
+version = "2.4"
source = { editable = "vendor/ts-tvl" }
dependencies = [
+ { name = "cffi" },
{ name = "crcmod" },
{ name = "cryptography" },
{ name = "isort" },
{ name = "jinja2" },
+ { name = "libcst" },
{ name = "pycln" },
{ name = "pycryptodome" },
{ name = "pydantic" },
@@ -2423,10 +2425,14 @@ dependencies = [
[package.metadata]
requires-dist = [
+ { name = "cffi", marker = "python_full_version == '3.8.*'", specifier = ">=1.12,<2.0" },
+ { name = "cffi", marker = "python_full_version >= '3.9'", specifier = ">=2.0" },
{ name = "crcmod", specifier = ">=1.7,<2.0" },
{ name = "cryptography", specifier = ">43" },
{ name = "isort", specifier = ">=5.13.2,<6.0.0" },
{ name = "jinja2", specifier = ">=3.1.4,<4.0.0" },
+ { name = "libcst", marker = "python_full_version == '3.8.*'", specifier = ">=1.1.0,<1.2.0" },
+ { name = "libcst", marker = "python_full_version >= '3.9'", specifier = ">=1.4.0" },
{ name = "pycln", specifier = ">=2.4.0,<3.0.0" },
{ name = "pycryptodome", specifier = ">=3.19.0,<4.0.0" },
{ name = "pydantic", specifier = ">=1.10.0,<2.0.0" },
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.