title: Address dependabot alerts state: OPEN author: dboreham labels: comments: 0 assignees: projects: milestone: number: 56 -- Dependabot has opened a bunch of alerts that all seem to be regarding the version of urllib3 that we are using.
gh api repos/stirlingbridge/machine/dependabot/alerts --jq '.[] | {number: .number, state: .state, package: .dependency.package.name, severity: .security_advisory.severity, summary: .security_advisory.summary}' 2>/dev/null | head -50{"number":8,"package":"black","severity":"high","state":"fixed","summary":"Black: Arbitrary file writes from unsanitized user input in cache file name"}
{"number":7,"package":"urllib3","severity":"high","state":"open","summary":"Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)"}
{"number":6,"package":"urllib3","severity":"high","state":"open","summary":"urllib3 streaming API improperly handles highly compressed data"}
{"number":5,"package":"urllib3","severity":"high","state":"open","summary":"urllib3 allows an unbounded number of links in the decompression chain"}
{"number":4,"package":"urllib3","severity":"medium","state":"open","summary":"urllib3 does not control redirects in browsers and Node.js"}
{"number":3,"package":"urllib3","severity":"medium","state":"open","summary":"urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation"}
{"number":2,"package":"requests","severity":"medium","state":"open","summary":"Requests vulnerable to .netrc credentials leak via malicious URLs"}
{"number":1,"package":"requests","severity":"medium","state":"fixed","summary":"Requests vulnerable to .netrc credentials leak via malicious URLs"} 1→[project]
2→name = "machine"
3→version = "1.0.0"
4→description = "Utility for creating and managing VMs"
5→readme = "README.md"
6→license = "AGPL-3.0-only"
7→requires-python = ">=3.8"
8→authors = [
9→ { name = "Stirlingbridge", email = "info@stirlingbridge.website" },
10→]
11→classifiers = [
12→ "Programming Language :: Python :: 3.8",
13→ "Operating System :: OS Independent",
14→]
15→dependencies = [
16→ "click==8.1.7",
17→ "python-digitalocean==1.17.0",
18→ "ruamel.yaml>=0.17.32",
19→ "requests==2.32.3",
20→ "expandvars==1.0.0",
21→ "vultr-python>=0.1.5",
22→]
23→
24→[project.scripts]
25→machine = "machine.main:main"
26→
27→[project.urls]
28→Homepage = "https://github.com/stirlingbridge/machine"
29→
30→[build-system]
31→requires = ["hatchling"]
32→build-backend = "hatchling.build"
33→
34→[tool.pytest.ini_options]
35→markers = [
36→ "e2e: end-to-end tests that create real resources on DigitalOcean (require E2E_* env vars)",
37→]
38→addopts = "-m 'not e2e'"
39→
40→[dependency-groups]
41→dev = [
42→ "ruff",
43→ "pytest",
44→]
45→
46→[tool.ruff]
47→line-length = 132
48→
49→[tool.ruff.lint]
50→select = ["E", "F", "W", "C90"]
51→ignore = ["E203"]
52→
53→[tool.ruff.lint.mccabe]
54→max-complexity = 25
55→
56→[tool.ruff.lint.per-file-ignores]
57→"machine/cloud_config.py" = ["E501"]
58→uv pip show urllib3 requests 2>/dev/null || uv run pip show urllib3 requests 2>/dev/null
Name: requests Version: 2.32.3 Location: /home/david/projects/stirlingbridge/machine/.venv/lib/python3.12/site-packages Requires: certifi, charset-normalizer, idna, urllib3 Required-by: machine, python-digitalocean, vultr-python --- Name: urllib3 Version: 2.6.3 Location: /home/david/projects/stirlingbridge/machine/.venv/lib/python3.12/site-packages Requires: Required-by: requests
gh api repos/stirlingbridge/machine/dependabot/alerts --jq '.[] | select(.state=="open") | {number: .number, package: .dependency.package.name, vulnerable_range: .security_vulnerability.vulnerable_version_range, first_patched: .security_vulnerability.first_patched_version.identifier, manifest: .dependency.manifest_path}'{"first_patched":"2.6.3","manifest":"uv.lock","number":7,"package":"urllib3","vulnerable_range":"\u003e= 1.22, \u003c 2.6.3"}
{"first_patched":"2.6.0","manifest":"uv.lock","number":6,"package":"urllib3","vulnerable_range":"\u003e= 1.0, \u003c 2.6.0"}
{"first_patched":"2.6.0","manifest":"uv.lock","number":5,"package":"urllib3","vulnerable_range":"\u003e= 1.24, \u003c 2.6.0"}
{"first_patched":"2.5.0","manifest":"uv.lock","number":4,"package":"urllib3","vulnerable_range":"\u003e= 2.2.0, \u003c 2.5.0"}
{"first_patched":"2.5.0","manifest":"uv.lock","number":3,"package":"urllib3","vulnerable_range":"\u003c 2.5.0"}
{"first_patched":"2.32.4","manifest":"uv.lock","number":2,"package":"requests","vulnerable_range":"\u003c 2.32.4"}grep -A2 'name = "urllib3"' /home/david/projects/stirlingbridge/machine/uv.lock; echo "---"; grep -A2 'name = "requests"' /home/david/projects/stirlingbridge/machine/uv.lock | head -10
{ name = "urllib3", version = "2.2.3", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.9'" },
{ name = "urllib3", version = "2.6.3", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.9'" },
]
sdist = { url = "https://files.pythonhosted.org/packages/63/70/2bf7780ad2d390a8d301ad0b550f1581eadbd9a20f896afe06353c2a2913/requests-2.32.3.tar.gz", hash = "sha256:55365417734eb18255590a9ff9eb97e9e1da868d4ccd6402399eaf68af20a760", size = 131218, upload-time = "2024-05-29T15:37:49.536Z" }
--
name = "urllib3"
version = "2.2.3"
source = { registry = "https://pypi.org/simple" }
--
name = "urllib3"
version = "2.6.3"
source = { registry = "https://pypi.org/simple" }
---
{ name = "requests" },
{ name = "ruamel-yaml" },
{ name = "vultr-python" },
--
{ name = "requests", specifier = "==2.32.3" },
{ name = "ruamel-yaml", specifier = ">=0.17.32" },
{ name = "vultr-python", specifier = ">=0.1.5" },
--
{ name = "requests" },
]Now I can see the issues clearly. The uv.lock has two problems:
pyproject.toml, but alert #2 needs >=2.32.4Since the project requires Python >=3.8, it supports the older Python where the vulnerable urllib3 2.2.3 gets resolved. However, the CLAUDE.md notes CI builds on Python 3.8.
Let me check what the latest urllib3 version is that supports Python 3.8, and what requests 2.32.4 requires.
uv pip index versions urllib3 2>/dev/null | head -5; echo "---"; uv pip index versions requests 2>/dev/null | head -5
The user doesn't want to proceed with this tool use. The tool use was rejected (eg. if it was a file edit, the new_string was NOT written to the file). STOP what you are doing and wait for the user to tell you how to proceed. Note: The user's next message may contain a correction or preference. Pay close attention — if they explain what went wrong or how they'd prefer you to work, consider saving that to memory for future sessions.
Instead of looking to maintain compatibility with Python 3.8 we can just move to a relatively recent Python version that allows easy compatibility with the fixed dependencies.
Makes sense. urllib3 2.6.3 (the fix for all 5 alerts) requires Python >=3.9, and the lock file already resolves it for that range. Let me bump the minimum to Python 3.10 (a reasonable modern baseline), update the pinned requests, and regenerate the lock.
requires-python = ">=3.8"
requires-python = ">=3.10"
The file /home/david/projects/stirlingbridge/machine/pyproject.toml has been updated successfully.
"Programming Language :: Python :: 3.8",
"Programming Language :: Python :: 3.10",
The file /home/david/projects/stirlingbridge/machine/pyproject.toml has been updated successfully.
"requests==2.32.3",
"requests>=2.32.4",
The file /home/david/projects/stirlingbridge/machine/pyproject.toml has been updated successfully.
Now let me also check the CI workflow for the Python version and regenerate the lock file.
{
"pattern": "3\\.8|python-version",
"path": "/home/david/projects/stirlingbridge/machine/.github",
"output_mode": "content"
}{
"pattern": "python",
"path": "/home/david/projects/stirlingbridge/machine/.github",
"output_mode": "content",
"-i": true
}.github/workflows/test.yml:20: - name: "Install Python" .github/workflows/test.yml:21: run: uv python install 3.13 .github/workflows/build-release.yml:18: - name: "Install Python" .github/workflows/build-release.yml:19: run: uv python install 3.13 .github/workflows/e2e-test.yml:27: - name: "Install Python" .github/workflows/e2e-test.yml:28: run: uv python install 3.13
Resolved 23 packages in 592ms Updated iniconfig v2.1.0, v2.3.0 -> v2.3.0 Updated pluggy v1.5.0, v1.6.0 -> v1.6.0 Updated pytest v8.3.5, v8.4.2, v9.0.2 -> v9.0.2 Updated requests v2.32.3 -> v2.32.5 Updated typing-extensions v4.13.2, v4.15.0 -> v4.15.0 Updated urllib3 v2.2.3, v2.6.3 -> v2.6.3
The key changes: urllib3 is now only 2.6.3 (the vulnerable 2.2.3 for Python <3.9 is gone), and requests updated to 2.32.5. Let me sync to verify everything works.
Resolved 23 packages in 0.76ms
Building machine @ file:///home/david/projects/stirlingbridge/machine
Built machine @ file:///home/david/projects/stirlingbridge/machine
Prepared 2 packages in 678ms
Uninstalled 2 packages in 4ms
Installed 2 packages in 1ms
~ machine==1.0.0 (from file:///home/david/projects/stirlingbridge/machine)
- requests==2.32.3
+ requests==2.32.5
Usage: machine [OPTIONS] COMMAND [ARGS]...
Options:
--debug Enable debug output
--quiet Suppress all non-essential outputEverything works. Here's what was changed to address all 6 open dependabot alerts:
==2.32.3 to >=2.32.4 — fixes the .netrc credential leak (alert #2)uv.lock — urllib3 now resolves to 2.6.3 only (fixes alerts #3-#7), requests to 2.32.5 (fixes alert #2)CI already builds on Python 3.13, so no workflow changes needed. Would you like me to commit this?