From 967d9f93c897050f8715d8bfa6c8aaabd2d5f254 Mon Sep 17 00:00:00 2001 From: Jac Fitzgerald Date: Thu, 20 Aug 2026 15:01:07 -0700 Subject: [PATCH] security: bump urllib3 floor to 2.6.3 for CVE-2026-21441 FOSSA flagged CVE-2026-21441 (GHSA-38jv-5279-wg99, 8.9 High) against urllib3 2.6.0. The fix landed in urllib3 2.6.3: streaming decompression safeguards were bypassed when HTTP redirects were followed. The existing `urllib3>=2.6.0,<3` specifier already permits 2.6.3, but because 2.6.0 remains a resolvable install, Dependabot did not open a range-bump PR, and this repo did not have the security-updates side of Dependabot expressed in its config either. This change: * Raises the floor in pyproject.toml to `urllib3>=2.6.3,<3` so fresh resolves cannot land on a vulnerable release. * Adds `open-pull-requests-limit: 10` to both dependabot ecosystems so security PRs are not squeezed out by the default cap of 5, and documents on the pip block that security advisories fire independently of the weekly schedule as long as "Dependabot security updates" is enabled under Settings -> Code security. * Adds a CHANGELOG entry naming the CVE and GHSA. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/dependabot.yml | 5 +++++ CHANGELOG.md | 7 +++++++ pyproject.toml | 2 +- 3 files changed, 13 insertions(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 38411afcc..1e2ae4b6a 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -3,11 +3,16 @@ updates: - package-ecosystem: "pip" directory: "/" target-branch: "development" + # Security advisories fire independently of the weekly schedule as long + # as the repo has "Dependabot security updates" enabled under + # Settings -> Code security. Weekly = non-security updates. schedule: interval: "weekly" + open-pull-requests-limit: 10 - package-ecosystem: "github-actions" directory: "/" target-branch: "development" schedule: interval: "weekly" + open-pull-requests-limit: 10 diff --git a/CHANGELOG.md b/CHANGELOG.md index 943436b27..45228027c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,13 @@ ## Unreleased +* Bumped the urllib3 floor to 2.6.3 to pick up the fix for CVE-2026-21441 + (GHSA-38jv-5279-wg99, 8.9 High): urllib3's streaming decompression + safeguards were bypassed when HTTP redirects were followed. TSC's manual + redirect walker (#1848) disables urllib3's built-in follower on new code + paths, but downstream callers using urllib3 directly (and TSC endpoints + that predate #1848) still relied on the built-in path, so the floor bump + closes the gap for all callers. The existing `<3` upper bound is unchanged. * Added `Projects.get_by_path(path)` to look up a project by its slash-separated hierarchy path (e.g. `"Marketing/Q1 Reports"`). The walk is performed level by level using the REST API name filter, so a path with *n* components issues *n* diff --git a/pyproject.toml b/pyproject.toml index e5a330c39..25e02e7a6 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -16,7 +16,7 @@ dependencies = [ 'defusedxml>=0.7.1', # latest as at 7/31/23 'packaging>=23.1', # latest as at 7/31/23 'requests>=2.32', # latest as at 7/31/23 - 'urllib3>=2.6.0,<3', + 'urllib3>=2.6.3,<3', 'typing_extensions>=4.0', ] requires-python = ">=3.10"