Repository navigation
chore(deps): refresh Python dependency lockfile - #15
Open
alexb-splunk wants to merge 1 commit into
Open
alexb-splunk wants to merge 1 commit into
alexb-splunk wants to merge 1 commit into
Conversation
Upgrade anyio from 4.14.1 to 4.15.1 to pick up the fix for CVE-2026-63374.
alexb-splunk
force-pushed
the
chore/refresh-lockfile
branch
from
October 16, 2026 19:46
8da18c2 to
5ed2f25
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR refreshes
uv.lockto pick up anyio 4.15.1. The previous lock pinned anyio 4.14.1, which is affected by CVE-2026-63374: before 4.14.2,anyio.connect_tcp()andTLSStream.wrap()can validate internationalized host names after an IDNA 2003 conversion instead of IDNA 2008.python-splunk-loggingdoes not reach the affected code. anyio is a transitive dependency of httpx, andHecForwarderuses the synchronoushttpx.Client. That client connects through httpcore'sSyncBackend, which uses the standard librarysocketandsslmodules, not anyio. Also, httpx encodes host names with IDNA 2008 before httpcore receives them. For these reasons, this PR adds no anyio constraint to the package metadata, and downstream installs keep resolving anyio through httpx.I ran
uv lock --upgrade, so the refresh also updates other locked packages. The runtime changes are anyio, certifi, and idna; httpx and httpcore are unchanged. The other updates are development tools, including major versions of isort (9), filelock (4), rich (15), and python-gitlab (8). The lint checks pass with the new tool versions and need no formatting changes.This PR changes only the lockfile. It does not change the package version or the dependency ranges in
pyproject.toml.This refresh supersedes #10, which updates a subset of the same development tools to older versions.