From 1332de88943a2286844520becad9ef91c22d6664 Mon Sep 17 00:00:00 2001 From: Harshith Date: Sat, 24 Oct 2026 20:57:54 +0530 Subject: [PATCH] deps: move versions.lock past new advisories (certifi, filelock, virtualenv) CI's pip-audit started failing every PR on advisories published this week against three pins: - certifi 2026.5.20 -> 2026.10.19 (PYSEC-2026-4320). This one ships: the container image installs from versions.lock. - filelock 3.29.0 -> 4.2.1 (three CVEs; no 3.x fix exists). Used only by virtualenv and python-discovery, both pre-commit tooling. Both accept 4.x (virtualenv: >=3.24.2,<5; python-discovery: >=3.16.1), and 4.2.1 needs Python 3.11, SENTINEL's floor. - virtualenv 21.7.13 -> 21.14.10 (eleven CVEs; 21.14.9 still had one more, CVE-2026-113713, fixed in 21.14.10). Its requirements raise packaging to 26.3 and distlib to 0.4.3, the smallest versions that satisfy them. Smallest fixed versions throughout, as CONTRIBUTING asks. pip-audit 2.10.1, run exactly as CI runs it, now finds no known vulnerabilities; scripts/check_versions_lock.py reports 0 conflicts; pip check finds no broken requirements; the full suite passes on the new pins. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 9 +++++++++ versions.lock | 10 +++++----- 2 files changed, 14 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index d11ea2a..a6eb7b0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,15 @@ All notable changes to this project are documented here. Format follows ## [Unreleased] +### Security +- `versions.lock` moves past newly published advisories: certifi 2026.10.19 + (PYSEC-2026-4320), and for the pre-commit tooling filelock 4.2.1 (three CVEs) + and virtualenv 21.14.10 (eleven CVEs against the old pin, and one more that + 21.14.9 still had). virtualenv's new requirements bring packaging 26.3 and + distlib 0.4.3. certifi is the one that ships: the container image installs + from the lock. `pip install sentinel-prox` is not pinned to the lock, so a + fresh install already picks up the fixed certifi. + ## [0.2.3] — 2026-10-19 **Upgrade from 0.2.2.** No configuration changes. If you use Cosmos DB, diff --git a/versions.lock b/versions.lock index e638a84..480f52a 100644 --- a/versions.lock +++ b/versions.lock @@ -8,17 +8,17 @@ azure-core==1.41.0 azure-cosmos==4.15.0 azure-identity==1.25.3 azure-storage-blob==12.29.0 -certifi==2026.5.20 +certifi==2026.10.19 cffi==2.0.0 cfgv==3.5.0 charset-normalizer==3.4.7 click==8.4.1 colorama==0.4.6 cryptography==50.0.1 -distlib==0.4.0 +distlib==0.4.3 distro==1.9.0 fastapi==0.136.3 -filelock==3.29.0 +filelock==4.2.1 h11==0.16.0 httpcore==1.0.9 httptools==0.8.0 @@ -39,7 +39,7 @@ mypy==2.1.0 mypy_extensions==1.1.0 nodeenv==1.10.0 openai==2.38.0 -packaging==26.2 +packaging==26.3 pathspec==1.1.1 platformdirs==4.10.0 pluggy==1.6.0 @@ -72,6 +72,6 @@ typing_extensions==4.15.0 urllib3==2.8.0 uvicorn==0.48.0 uvloop==0.23.0 -virtualenv==21.7.13 +virtualenv==21.14.10 watchfiles==1.2.0 websockets==16.0