SYN-642: Clear high-severity Dependabot findings in pip deps - #221
Conversation
Bump urllib3 1.26.12->2.7.0, certifi 2022.12.7->2026.7.22, requests 2.28.1->2.34.2 (needed for urllib3 2.x compat, unused at runtime), and idna 3.3->3.19 in requirements.txt. Pin setuptools>=78.1.1,<81 via a new pyproject.toml [build-system] table, since it wasn't declared as a dependency anywhere. Update CI matrix to Python 3.10/3.11/3.12 since the new dependency floors require it (3.8/3.9 are EOL). Verified: 247/247 unit tests pass, full integration suite run against the live API (135/148 pass, with the 13 pre-existing failures proven identical on old vs new deps), pip-audit goes from 23 findings/4 packages to 0, and a real `python -m build --sdist` confirms the setuptools pin works. Also dismissed 9 stale Dependabot alerts (#5, #11, #14, #29, #32, #41, #42, #44, #51) attributed to Pipfile.lock, which was removed from this repo in 0660e89 (2022-09-19) and no longer exists.
| requests==2.34.2 | ||
| six==1.16.0 | ||
| urllib3==1.26.12 | ||
| urllib3==2.7.0 |
There was a problem hiding this comment.
Major version bump (1.x to 2.x), not just a patch. Verified this doesn't break the SDK: grepped every direct urllib3 call in lob_python/ (getheaders, getheader, ProxyManager, PoolManager, Timeout, exceptions.SSLError, fields.RequestField, util.make_headers) and confirmed each still works by actually installing 2.7.0 and exercising them, plus a real end-to-end request against api.lob.com.
| @@ -1,9 +1,9 @@ | |||
| certifi==2022.12.7 | |||
| certifi==2026.7.22 | |||
There was a problem hiding this comment.
Ticket (SYN-642) asked for 2023.7.22, but that leaves PYSEC-2024-230 open. Went to latest since certifi has no API surface to break, just a CA bundle.
| lob==4.5.4 | ||
| python-dateutil==2.8.2 | ||
| requests==2.28.1 | ||
| requests==2.34.2 |
There was a problem hiding this comment.
Not in the ticket, but required: 2.28.1 pins urllib3<1.27, incompatible with the urllib3 bump below. Also had 4 of its own CVEs, all fixed here. Not imported anywhere in lob_python/, so no runtime risk.
| certifi==2026.7.22 | ||
| charset-normalizer==2.1.1 | ||
| idna==3.3 | ||
| idna==3.19 |
There was a problem hiding this comment.
Also not in the ticket. idna 3.3 had 2 open CVEs (PYSEC-2024-60, PYSEC-2026-215), both fixed by 3.19.
| @@ -0,0 +1,3 @@ | |||
| [build-system] | |||
| requires = ["setuptools>=78.1.1,<81"] | |||
There was a problem hiding this comment.
setuptools wasn't declared as a dependency anywhere in this repo (not in requirements.txt, not in setup.py), which is why Dependabot's 3 High findings for it couldn't be closed by editing requirements.txt. This is the actual place a build-tool floor belongs. Capped at <81 per review feedback, since an unbounded floor could pull in a future breaking setuptools release.
| strategy: | ||
| matrix: | ||
| python-version: ["3.8", "3.9", "3.11"] | ||
| python-version: ["3.10", "3.11", "3.12"] |
There was a problem hiding this comment.
Dropped 3.8/3.9 because urllib3 2.7.0 / requests 2.34.2 / setuptools>=78.1.1 all require Python >=3.10 (3.8 EOL'd Oct 2024, 3.9 EOLs Oct 2025). This only affects what we test in CI, not what the published package supports: setup.py's python_requires is already unrestricted and install_requires only floors urllib3 >= 1.25.3 with no ceiling, both unchanged here.
2 participants
What problem are you trying to solve?
How did you solve this problem?
Important notes
return_envelopemodel bug, unrelated to this change.Test plan
pip-audit -r requirements.txt-> 0 findings (was 23 across 4 packages)python -m unittest test/Unit/test_*.py-> 247/247 passpython -m unittest discover test/Integration(needs LOB_API_TEST_KEY) -> 135/148 pass, same as mainpython -m build --sdistsucceeds with the new pyproject.toml