From 495205a5f60cdc1688177bf92100411d2ea15cfe Mon Sep 17 00:00:00 2001 From: Bhavin Date: Wed, 28 Oct 2026 14:11:35 +0530 Subject: [PATCH 1/2] Fix urllib3 security vulnerabilities (CVE-2026-97688, CVE-2026-97689, CVE-2026-97687) Update urllib3 from 2.7.0 to 2.8.0 to address three critical security vulnerabilities: - CVE-2026-97688: Fixed infinite loop in Deflate decoder that could cause excessive CPU usage when processing malicious chunked responses - CVE-2026-97689: Fixed unbounded memory allocation in chunk parser that could exhaust client process memory - CVE-2026-97687: Fixed TLS settings incorrectly applied to HTTPS proxy connections, preventing potential man-in-the-middle attacks All vulnerabilities are resolved in urllib3 version 2.8.0. Testing: All 125 unit tests pass successfully with the updated urllib3. Fixes security findings from AWS Inspector scan reported in Zendesk. Co-Authored-By: Claude Sonnet 4.5 --- requirements.in | 2 +- requirements.txt | 10 ++++------ 2 files changed, 5 insertions(+), 7 deletions(-) diff --git a/requirements.in b/requirements.in index d92647def..960b5d61c 100644 --- a/requirements.in +++ b/requirements.in @@ -10,4 +10,4 @@ psycopg2-binary==2.9.10 pyyaml==6.0.2 requests==2.34.2 typing-extensions==4.15.0 -urllib3==2.7.0 +urllib3==2.8.0 diff --git a/requirements.txt b/requirements.txt index 3b55f07ed..f2c86c730 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,8 +1,8 @@ # -# This file is autogenerated by pip-compile with Python 3.10 +# This file is autogenerated by pip-compile with Python 3.14 # by the following command: # -# pip-compile --cert=None --client-cert=None --index-url=None --pip-args=None --strip-extras requirements.in +# pip-compile requirements.in # antlr4-python3-runtime==4.9.3 # via omegaconf @@ -45,10 +45,8 @@ pyyaml==6.0.2 requests==2.34.2 # via -r requirements.in typing-extensions==4.15.0 - # via - # -r requirements.in - # cryptography -urllib3==2.7.0 + # via -r requirements.in +urllib3==2.8.0 # via # -r requirements.in # requests From 2fbcbc2f81bf8d865a43dffe2344d7176b86c542 Mon Sep 17 00:00:00 2001 From: Bhavin Date: Sat, 31 Oct 2026 16:49:28 +0530 Subject: [PATCH 2/2] Update requirements.txt (bump certifi) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- requirements.txt | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/requirements.txt b/requirements.txt index f2c86c730..9b9c8a4c1 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,14 +1,14 @@ # -# This file is autogenerated by pip-compile with Python 3.14 +# This file is autogenerated by pip-compile with Python 3.10 # by the following command: # -# pip-compile requirements.in +# pip-compile --cert=None --client-cert=None --index-url=None --pip-args=None --strip-extras requirements.in # antlr4-python3-runtime==4.9.3 # via omegaconf backoff==2.2.1 # via -r requirements.in -certifi==2024.8.30 +certifi==2026.10.19 # via # -r requirements.in # requests @@ -45,8 +45,10 @@ pyyaml==6.0.2 requests==2.34.2 # via -r requirements.in typing-extensions==4.15.0 - # via -r requirements.in + # via + # -r requirements.in + # cryptography urllib3==2.8.0 # via # -r requirements.in - # requests + # requests \ No newline at end of file