From cae6ce979a1db79ec1e6b78a3c1985884bee2ba2 Mon Sep 17 00:00:00 2001 From: Paige Patton <64206430+paigerube14@users.noreply.github.com> Date: Tue, 5 May 2026 08:38:31 -0500 Subject: [PATCH] bump vulnerable transitive dependencies to patched versions (#1266) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - kubernetes: ==34.1.0 → >=35.0.0 (unlocks urllib3 v2.x support) - urllib3: >=2.1.0,<2.4.0 → >=2.6.3 (CVEs: decompression bombs, redirect bypass) - cryptography: >=42.0.4 → >=46.0.7 (subgroup attack, buffer overflow, DNS CVEs) - requests: stays <2.32; blocked by docker-py 6.x Unix socket dependency (fix: upgrade docker to >=7.0 and requests to >=2.33.0 in a follow-up) Signed-off-by: Paige Patton Co-authored-by: Claude Sonnet 4.6 --- requirements.txt | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/requirements.txt b/requirements.txt index 38750f96..e149769a 100644 --- a/requirements.txt +++ b/requirements.txt @@ -8,7 +8,7 @@ azure-mgmt-compute==30.5.0 azure-mgmt-network==27.0.0 coverage==7.6.12 datetime==5.4 -docker>=6.0,<7.0 # docker 7.0+ has breaking changes; works with requests<2.32 +docker>=6.0,<7.0 # docker 7.0+ has breaking changes; upgrade to 7.x to allow requests>=2.33.0 gitpython==3.1.47 google-auth==2.37.0 google-cloud-compute==1.22.0 @@ -16,8 +16,8 @@ ibm_cloud_sdk_core>=3.20.0 # Requires urllib3>=2.1.0 (compatible with updated b ibm_vpc==0.26.3 # Requires ibm_cloud_sdk_core jinja2==3.1.6 lxml==6.1.0 -kubernetes==34.1.0 -krkn-lib==6.0.6 +kubernetes>=35.0.0 +krkn-lib==6.0.7 numpy==1.26.4 pandas==2.2.0 openshift-client==1.0.21 @@ -27,9 +27,9 @@ pyfiglet==1.0.2 pytest==9.0.3 python-ipmi==0.5.4 python-openstackclient==6.5.0 -requests<2.32 # requests 2.32+ breaks Unix socket support (http+docker scheme) +requests<2.32 # requests 2.32+ breaks docker Unix socket support; blocked until docker>=7.0 requests-unixsocket>=0.4.0 # Required for Docker Unix socket support -urllib3>=2.1.0,<2.4.0 # Compatible with all dependencies +urllib3>=2.6.3 # CVE fixes; kubernetes>=35.0.0 allows urllib3>=2.x service_identity==24.1.0 PyYAML==6.0.1 setuptools==78.1.1 @@ -38,5 +38,5 @@ zope.interface==6.1 colorlog==6.10.1 git+https://github.com/vmware/vsphere-automation-sdk-python.git@v8.0.0.0 -cryptography>=42.0.4 # not directly required, pinned by Snyk to avoid a vulnerability +cryptography>=46.0.7 # pinned to avoid multiple CVEs (subgroup attack, buffer overflow, DNS constraints) protobuf>=4.25.8 # not directly required, pinned by Snyk to avoid a vulnerability