Skip to content

[Snyk] Security upgrade urllib3 from 2.0.7 to 2.5.0 #61

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: dev
Choose a base branch
from
Open

[Snyk] Security upgrade urllib3 from 2.0.7 to 2.5.0 #61

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions requires-install.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,3 +10,4 @@ requests
retrying
nest-asyncio
setuptools
urllib3>=2.5.0 # not directly required, pinned by Snyk to avoid a vulnerability
Copy link

@gemini-code-assist gemini-code-assist bot Jun 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

Potential Dependency Incompatibility - Verification Needed

Snyk's metadata for this PR (visible in the PR description's raw markdown) states this is an upgrade from urllib3 2.0.7 to 2.5.0. If urllib3 2.0.7 was indeed the version in use, your requests dependency (currently unpinned in this file) should have resolved to a version compatible with urllib3 2.x (i.e., requests >= 2.32.0).

However, the Snyk PR description also prominently displays a warning: requests 2.31.0 requires urllib3, which is not installed. Version 2.31.0 of requests is not compatible with urllib3 2.x, as it specifically requires urllib3 < 1.27. This information is contradictory and presents a risk.

Action Required:

  1. Verify your project's currently resolved requests and urllib3 versions in your development and production environments.
  2. Scenario A: If requests is < 2.32.0 (e.g., 2.31.0 as per the Snyk warning):
    This pin to urllib3>=2.5.0 will cause a dependency conflict and likely break your application.
    • Solution 1 (Recommended): Upgrade requests to requests>=2.32.0 and explicitly pin it in requires-install.txt. This urllib3 pin would then be compatible.
    • Solution 2: If requests cannot be upgraded, this urllib3 pin to 2.5.0 is incorrect. You must use a urllib3 1.x version that fixes the Snyk vulnerabilities and is compatible with your requests version (e.g., urllib3>=1.26.18,<1.27). You would need to verify which 1.x version is appropriate and modify this line accordingly. See the code suggestion for an example of what this line might look like in that case.
  3. Scenario B: If requests is already >= 2.32.0 (and urllib3 2.0.7 was indeed in use):
    This urllib3>=2.5.0 pin is likely compatible. For robustness and clarity, consider explicitly pinning your requests version (e.g., requests>=2.32.0) in requires-install.txt to ensure continued compatibility and prevent accidental resolution to an older, incompatible requests version in the future.

Please investigate this potential discrepancy thoroughly before merging to prevent runtime failures.

urllib3>=1.26.18,<1.27 # Example: IF requests < 2.32.0 is used AND this 1.x version fixes Snyk issues AND is compatible. VERIFY!