Repository navigation
Bump fsspec from 2025.5.1 to 2026.6.0 - #1426
Merged
Merged
Conversation
Bumps [fsspec](https://github.com/fsspec/filesystem_spec) from 2025.5.1 to 2026.6.0. - [Commits](fsspec/filesystem_spec@2025.5.1...2026.6.0) --- updated-dependencies: - dependency-name: fsspec dependency-version: 2026.6.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Update the locked transitive fsspec dependency from 2025.5.1 to 2026.6.0, the first patched version for GHSA-27vj-qcqg-25rc / CVE-2026-104851. The advisory concerns template injection when parsing fsspec reference-filesystem documents.
Review found no compatibility issue: fsspec 2026.6.0 requires Python >=3.10, matching phy, and is installed through phylib → Dask → fsspec. Phy and phylib have no direct fsspec calls. The PR changes only fsspec's version and verified PyPI artifact hashes in uv.lock.
Validation: the integrated phy 2.2 branch with phylib 2.7.1, Tornado 6.5.10 and fsspec 2026.6.0 passed make test-full (495 core/GUI and 155 application tests, one existing visual benchmark skipped), lint/formatting, and uv build. Artifact hashes and Python metadata were checked against PyPI. The original full GitHub CI matrix passed; the branch has now been updated to current master and must pass the refreshed matrix before merge.
Execution — 8 October 2026
The refreshed full CI matrix, documentation, spelling, and package build passed on
de58337c. Merged fsspec 2026.6.0 as8ac76e86.