seb/hermes-agent
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(deps): bump urllib3 and PyJWT to clear CVEs (#40179)

Browse Source 
* fix(deps): bump urllib3 and PyJWT to clear CVEs

urllib3 2.6.3 → 2.7.0: fixes GHSA-mf9v-mfxr-j63j (decompression-bomb
bypass in streaming API) and GHSA-qccp-gfcp-xxvc (sensitive headers
forwarded across origins in proxied redirects).

PyJWT 2.12.1 → 2.13.0: fixes PYSEC-2026-175/177/178/179.

Note: python-multipart and idna are already at patched versions in
uv.lock (0.0.27 and 3.15 respectively).

Fixes #40176

* fix(deps): add upper bound for urllib3 dependency spec

Add '<3' ceiling to urllib3 specifier to satisfy the PyPI dependency
upper bounds CI check. Per CONTRIBUTING.md policy, all PyPI deps must
use '>=floor,<next_major' pinning.
This commit is contained in:
liuhao1024
2026-06-09 11:19:05 -04:00
committed by GitHub
parent 92dfd70d6a
commit f6416f50fc
2 changed files with 13 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pyproject.toml
+4 -1
View File
@@ -82,7 +82,10 @@ dependencies = [
# it out of the lazy-install path that exists only for the heavy matrix deps.
"Markdown==3.10.2",
# Skills Hub (GitHub App JWT auth — optional, only needed for bot identity)
"PyJWT[crypto]==2.12.1", # CVE-2026-32597
"PyJWT[crypto]==2.13.0", # PYSEC-2026-175/177/178/179
# urllib3 2.7.0 fixes GHSA-mf9v-mfxr-j63j (decompression-bomb bypass)
# and GHSA-qccp-gfcp-xxvc (header leak across origins).
"urllib3>=2.7.0,<3",
# Windows has no IANA tzdata shipped with the OS, so Python's ``zoneinfo``
# (PEP 615) raises ``ZoneInfoNotFoundError`` for every non-UTC timezone
# out of the box. ``tzdata`` ships the Olson database as a data package