Skip to content

SYN-642: Clear high-severity Dependabot findings in pip deps #221

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
KARSE22 merged 2 commits into from
Sep 1, 2026
Merged

SYN-642: Clear high-severity Dependabot findings in pip deps #221

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f90dab7
chore(SYN-642): clear high-severity Dependabot findings in pip deps
KARSE22 Sep 1, 2026
18d08b2
Bump version to 5.2.1
KARSE22 Sep 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/run_tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ jobs:
runs-on: ubuntu-latest
strategy:
matrix:
python-version: ["3.8", "3.9", "3.11"]
python-version: ["3.10", "3.11", "3.12"]

@KARSE22 KARSE22 Sep 1, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dropped 3.8/3.9 because urllib3 2.7.0 / requests 2.34.2 / setuptools>=78.1.1 all require Python >=3.10 (3.8 EOL'd Oct 2024, 3.9 EOLs Oct 2025). This only affects what we test in CI, not what the published package supports: setup.py's python_requires is already unrestricted and install_requires only floors urllib3 >= 1.25.3 with no ceiling, both unchanged here.

steps:
- uses: actions/checkout@v4

Expand Down
3 changes: 3 additions & 0 deletions pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
[build-system]
requires = ["setuptools>=78.1.1,<81"]

@KARSE22 KARSE22 Sep 1, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

setuptools wasn't declared as a dependency anywhere in this repo (not in requirements.txt, not in setup.py), which is why Dependabot's 3 High findings for it couldn't be closed by editing requirements.txt. This is the actual place a build-tool floor belongs. Capped at <81 per review feedback, since an unbounded floor could pull in a future breaking setuptools release.

build-backend = "setuptools.build_meta"
8 changes: 4 additions & 4 deletions requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
certifi==2022.12.7
certifi==2026.7.22

@KARSE22 KARSE22 Sep 1, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ticket (SYN-642) asked for 2023.7.22, but that leaves PYSEC-2024-230 open. Went to latest since certifi has no API surface to break, just a CA bundle.

charset-normalizer==2.1.1
idna==3.3
idna==3.19

@KARSE22 KARSE22 Sep 1, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also not in the ticket. idna 3.3 had 2 open CVEs (PYSEC-2024-60, PYSEC-2026-215), both fixed by 3.19.

lob==4.5.4
python-dateutil==2.8.2
requests==2.28.1
requests==2.34.2

@KARSE22 KARSE22 Sep 1, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not in the ticket, but required: 2.28.1 pins urllib3<1.27, incompatible with the urllib3 bump below. Also had 4 of its own CVEs, all fixed here. Not imported anywhere in lob_python/, so no runtime risk.

six==1.16.0
urllib3==1.26.12
urllib3==2.7.0

@KARSE22 KARSE22 Sep 1, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Major version bump (1.x to 2.x), not just a patch. Verified this doesn't break the SDK: grepped every direct urllib3 call in lob_python/ (getheaders, getheader, ProxyManager, PoolManager, Timeout, exceptions.SSLError, fields.RequestField, util.make_headers) and confirmed each still works by actually installing 2.7.0 and exercising them, plus a real end-to-end request against api.lob.com.

python-dotenv>=0.21.0
2 changes: 1 addition & 1 deletion setup.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
from setuptools import setup, find_packages # noqa: H301

NAME = "lob-python"
VERSION = "5.2.0"
VERSION = "5.2.1"
# To install the library, run the following
#
# python setup.py install
Expand Down
Loading