From 4556581b16561e5e5ad268135d53fc5071dcd772 Mon Sep 17 00:00:00 2001 From: Vinit Kumar Date: Thu, 15 Oct 2026 13:57:58 +0530 Subject: [PATCH] fix: require urllib3 2.8.0 for security fixes --- BENCHMARKS.md | 2 +- docs/benchmarks.rst | 2 +- lat.md/architecture.md | 2 ++ pyproject.toml | 2 +- uv.lock | 10 +++++----- 5 files changed, 10 insertions(+), 8 deletions(-) diff --git a/BENCHMARKS.md b/BENCHMARKS.md index 17368ee..a491374 100644 --- a/BENCHMARKS.md +++ b/BENCHMARKS.md @@ -140,7 +140,7 @@ uv python list 3.15 --all-versions uv run --isolated --managed-python \ --python cpython-3.15.0rc1-macos-aarch64-none \ --with defusedxml \ - --with 'urllib3>=2.7.0' \ + --with 'urllib3>=2.8.0' \ python benchmarks/benchmark_security_hardening.py \ --before 826439f \ --after 48dfd38 \ diff --git a/docs/benchmarks.rst b/docs/benchmarks.rst index 92ae442..fc607d3 100644 --- a/docs/benchmarks.rst +++ b/docs/benchmarks.rst @@ -218,7 +218,7 @@ uv 0.11.24 did not yet list rc1, so it was updated to 0.12.3. That release downl uv run --isolated --managed-python \ --python cpython-3.15.0rc1-macos-aarch64-none \ --with defusedxml \ - --with 'urllib3>=2.7.0' \ + --with 'urllib3>=2.8.0' \ python benchmarks/benchmark_security_hardening.py \ --before 826439f \ --after 48dfd38 \ diff --git a/lat.md/architecture.md b/lat.md/architecture.md index 54ec1f6..b8015a9 100644 --- a/lat.md/architecture.md +++ b/lat.md/architecture.md @@ -94,6 +94,8 @@ Dependency floors and lockfiles keep known vulnerable packages out of runtime an Runtime dependencies are declared in `pyproject.toml` and mirrored by `uv.lock`; legacy requirements inputs remain pinned for tooling that still consumes requirements files. Security fixes should update both resolver paths so `uv audit` and requirements-based installs agree. +The urllib3 runtime floor is 2.8.0, excluding CVE-2026-97687 (HTTPS proxy TLS configuration), CVE-2026-97688 (Deflate streaming loop), and CVE-2026-97689 (unbounded chunk-size buffering). The lockfile and standalone benchmark commands use the same safe floor; `docs/requirements.txt` already pins 2.8.0. urllib3 supports Python 3.10+, so this preserves json2xml's Python 3.11+ requirement. + The Rust accelerator requires PyO3 0.29.1 or newer in the 0.29 series, excluding releases affected by GHSA-36hh-v3qg-5jq4's out-of-bounds list and tuple iterator reads. Documentation builds declare Requests 2.34.2 as their minimum and regenerate `docs/requirements.txt` with pip-tools so transitive Sphinx resolution cannot select an older release. diff --git a/pyproject.toml b/pyproject.toml index f7c0e7a..a9e7f9c 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -28,7 +28,7 @@ classifiers = [ ] dependencies = [ "defusedxml", - "urllib3>=2.7.0", + "urllib3>=2.8.0", ] [project.urls] diff --git a/uv.lock b/uv.lock index 35fd6e0..8a40759 100644 --- a/uv.lock +++ b/uv.lock @@ -1,5 +1,5 @@ version = 1 -revision = 3 +revision = 5 requires-python = ">=3.11" [[package]] @@ -192,7 +192,7 @@ requires-dist = [ { name = "pytest-xdist", marker = "extra == 'dev'", specifier = ">=3.8.0" }, { name = "ruff", marker = "extra == 'dev'", specifier = ">=0.16.3" }, { name = "setuptools", marker = "extra == 'dev'", specifier = ">=80.9.0" }, - { name = "urllib3", specifier = ">=2.7.0" }, + { name = "urllib3", specifier = ">=2.8.0" }, { name = "xmltodict", marker = "extra == 'dev'", specifier = ">=0.14.2" }, ] provides-extras = ["dev", "fast"] @@ -386,11 +386,11 @@ wheels = [ [[package]] name = "urllib3" -version = "2.7.0" +version = "2.8.0" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/53/0c/06f8b233b8fd13b9e5ee11424ef85419ba0d8ba0b3138bf360be2ff56953/urllib3-2.7.0.tar.gz", hash = "sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c", size = 433602, upload-time = "2026-05-07T16:13:18.596Z" } +sdist = { url = "https://files.pythonhosted.org/packages/e3/05/b17359e1cefb4f909b5e40b1b90a496d987258916dbbf88e842c729f510e/urllib3-2.8.0.tar.gz", hash = "sha256:63bf2ead4c879426ebf22ef2a781eeb4aa3b4ae798a0435506f8687fd5bb9b63", size = 458972, upload-time = "2026-09-15T19:29:36.253Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/7f/3e/5db95bcf282c52709639744ca2a8b149baccf648e39c8cc87553df9eae0c/urllib3-2.7.0-py3-none-any.whl", hash = "sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897", size = 131087, upload-time = "2026-05-07T16:13:17.151Z" }, + { url = "https://files.pythonhosted.org/packages/92/9d/c4e665119135114480843e7ab388fa94d8480650450e6f8e26b70d323a4c/urllib3-2.8.0-py3-none-any.whl", hash = "sha256:0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3", size = 135717, upload-time = "2026-09-15T19:29:34.577Z" }, ] [[package]]