Repository navigation
fix!: bump urllib3, pytest, filelock and require Python 3.10+ (dependency vulnerability fixes) - #23
Open
devin-ai-integration[bot] wants to merge 1 commit into
Conversation
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Author
|
I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dependency vulnerability fixes (automated)
Generated by the Devin Dependency Security Vuln Fix automation run on 2026-10-19.
Change type: Major version bump — includes source/config changes to adapt to a breaking change.
Warning
We're not just looking for a review like a normal PR. Security can offer this fix as a recommendation, but doesn't have the tooling or domain knowledge to safely verify changes like this end-to-end for each repo. Please review, test, and own deployment before merging. For more information: https://launchdarkly.atlassian.net/wiki/spaces/SEC/pages/5360943572/Dependency+Vulnerability+Remediation+with+Devin.
Findings addressed
Breaking change for consumers (hence
fix!:): every patched release above (urllib3 2.7.0, pytest 9.0.3, filelock 3.20.3) declaresRequires-Python >=3.10, so the package's supported-Python floor is raised 3.9 → 3.10 (Python 3.9 is upstream EOL since Oct 2025):pyproject.tomlrequires-pythonandsetup.pyPYTHON_REQUIRES:>=3.9→>=3.10.github/workflows/python.ymlmatrix: dropped3.9README.md: "Python 3.9+" → "Python 3.10+"requirements.txt/test-requirements.txt/pyproject.tomldev group mirror the new floors (filelock >= 3.20.3added explicitly).The three findings are grouped in one PR because they all depend on the same Python-floor change; no library source code changed.
Generator note: these files are produced by openapi-generator from
ld-openapi. Unless the generator config/templates there are updated to match (Python floor and dependency floors), the next automated release will regenerate and revert these lines — please mirror the change upstream.Deferred / excluded findings
Verification
pip install -r requirements.txt -r test-requirements.txt && pip install -e .+pip checkon Python 3.10.20 and 3.12.13; resolved urllib3 2.8.0, pytest 9.1.1, filelock 4.0.11). Confirmedpip installon Python 3.9 is now rejected byRequires-Python, as intended.python -m buildsdist + wheel)pytest— 1059 passed on 3.10 and 3.12)flake8 --select=E9,F63,F7,F82— 0 issues; CI does not run a linter)Refreshed 2026-10-19: branch is current with
main(0 commits behind); no new findings for this group. Re-verified locally on Python 3.10 (pip install -r requirements.txt -r test-requirements.txt,pytest— 1059 passed; resolved urllib3 2.8.0, pytest 9.1.1, filelock 4.1.0); CI build 3.10–3.13 green. Wiz MCP was unavailable again during the 2026-10-19 run (two attempts failed), so Wiz-sourced rows carry over from the 2026-10-05 reconcile; Dependabot data re-checked 2026-10-19 13:15Z.Link to Devin session: https://app.devin.ai/sessions/5b3dadfc1dae431aa2d1be4f9f0d2fd0