Skip to content

chore(deps): sdk-5393 update compatible security dependencies - #140

Merged
dciccale merged 1 commit into
masterfrom
chore/sdk-5393-update-compatible-security-dependencies
Sep 7, 2026
Merged

chore(deps): sdk-5393 update compatible security dependencies#140
dciccale merged 1 commit into
masterfrom
chore/sdk-5393-update-compatible-security-dependencies

Conversation

@dciccale

@dciccale dciccale commented Sep 7, 2026

Copy link
Copy Markdown

The SDK currently permits Requests 2.32.3 and IDNA versions affected by the credential-leak and input-processing advisories. Raise the published minimums to requests>=2.32.4,<3.0 and idna>=3.15,<4.0, and update the matching repository pins. The explicit IDNA requirement prevents Requests from resolving an older vulnerable version.

This is the Python 3.8-compatible security subset of #126. Python support remains >=3.8; the remaining dependency updates and advisories stay in SDK-5393, with Python support changes tracked separately in SDK-5392. This PR addresses Dependabot alerts #2 and #13.

Validation:

  • Built the source distribution and wheel with the repository's build-tool versions; both passed twine check.
  • Installed the wheel with normal dependency resolution on Python 3.8 and 3.12; all 86 repository tests passed on each version, including the real local HTTP proxy test. Confirmed the SDK imports came from the installed wheel.
  • Verified the wheel metadata rejects Requests 2.32.3 and IDNA 3.14, accepts the new minimums, and preserves Requires-Python: >=3.8.0.
  • Repository fatal-error lint and git diff --check passed. Regenerated requirements.txt with pip-tools 7.4.1 on Python 3.12.

Partial progress on SDK-5393. Python support changes: SDK-5392.

@dciccale
dciccale requested a review from a team as a code owner September 7, 2026 08:46
@dciccale
dciccale merged commit e9e92be into master Sep 7, 2026
14 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants