Skip to content

Fix all open Dependabot Python alerts in Pipfiles - #8488

Merged
ihalatci merged 6 commits into
mainfrom
chore/dependabot-alerts-python-20260303
Mar 4, 2026
Merged

Fix all open Dependabot Python alerts in Pipfiles#8488
ihalatci merged 6 commits into
mainfrom
chore/dependabot-alerts-python-20260303

Conversation

@ihalatci

@ihalatci ihalatci commented Mar 3, 2026

Copy link
Copy Markdown
Contributor

Summary

This PR addresses all currently open Dependabot alerts in this repository by updating vulnerable Python dependencies in both mirrored regression-test environments:

  • src/test/regress/Pipfile / Pipfile.lock
  • .devcontainer/src/test/regress/Pipfile / Pipfile.lock

Updated dependencies

  • cryptography: 44.0.3 -> 46.0.5 (patched: >=46.0.5)
  • Werkzeug: 3.1.4 -> 3.1.5 (patched: >=3.1.5)
  • filelock: resolved to 3.25.0 (patched: >=3.20.3)
  • pyasn1: resolved to 0.6.2 (patched: >=0.6.2)

Alerts covered

Closes Dependabot alerts: #98, #99, #100, #101, #102, #103, #104, #105, #106, #107, #108, #109.

Notes

Lockfiles were regenerated with pipenv lock in both directories to ensure consistent, hashed resolution.

@ihalatci

ihalatci commented Mar 3, 2026

Copy link
Copy Markdown
Contributor Author

Supersedes Dependabot PRs #8444, #8445, #8450, #8452, #8455, #8456, #8474, and #8476 with one consolidated Pipfile/Pipfile.lock security update.

@codecov

codecov Bot commented Mar 3, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.90%. Comparing base (d3330fd) to head (d1c57c7).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #8488      +/-   ##
==========================================
- Coverage   88.91%   88.90%   -0.01%     
==========================================
  Files         286      286              
  Lines       63109    63109              
  Branches     7910     7910              
==========================================
- Hits        56114    56108       -6     
- Misses       4730     4733       +3     
- Partials     2265     2268       +3     
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@ihalatci
ihalatci enabled auto-merge (squash) March 4, 2026 11:41
@ihalatci
ihalatci merged commit 366fd64 into main Mar 4, 2026
128 checks passed
@ihalatci
ihalatci deleted the chore/dependabot-alerts-python-20260303 branch March 4, 2026 11:54
ihalatci added a commit that referenced this pull request Jun 4, 2026
DESCRIPTION: Update mitmproxy fork to lift pyOpenSSL cap; re-lock to
26.2.0 (closes CVE-2026-27459, CVE-2026-27448)

## Summary

Bumps the `mitmproxy` git ref in both Pipfiles from the pinned commit
SHA `70bad9a3c098...` to track `citusdata/mitmproxy@main`. After
[citusdata/mitmproxy#4](citusdata/mitmproxy#4)
(merge of upstream `mitmproxy/mitmproxy@main`), our fork's `main` caps
`pyOpenSSL<=27.0.0` (was `<=25.3.0`), unblocking the lockfile from
resolving past pyOpenSSL 25.3.0.

Re-locking both Pipfiles via `pipenv lock` resolves `pyopenssl` to
**26.2.0**, closing all four currently-open Dependabot security alerts:

| Alert | CVE | Severity | Patched version |
|---|---|---|---|
| [#126](https://github.com/citusdata/citus/security/dependabot/126) /
[#125](https://github.com/citusdata/citus/security/dependabot/125) |
[CVE-2026-27459](https://nvd.nist.gov/vuln/detail/CVE-2026-27459)
([GHSA-5pwr-322w-8jr4](GHSA-5pwr-322w-8jr4))
| **High** | `>=26.0.0` |
| [#124](https://github.com/citusdata/citus/security/dependabot/124) /
[#123](https://github.com/citusdata/citus/security/dependabot/123) |
[CVE-2026-27448](https://nvd.nist.gov/vuln/detail/CVE-2026-27448)
([GHSA-vp96-hxj8-p424](GHSA-vp96-hxj8-p424))
| Low | `>=26.0.0` |

## Pipfile changes

Single line per file, in both:
- `src/test/regress/Pipfile`
- `.devcontainer/src/test/regress/Pipfile`

```diff
-mitmproxy = {git = "https://github.com/citusdata/mitmproxy.git", ref = "70bad9a3c098f605e5f8b25553e5db5334018ff1"}
+mitmproxy = {git = "https://github.com/citusdata/mitmproxy.git", ref = "main"}
```

The `ref="main"` form is supported by pipenv for git deps; the resolved
commit SHA (`df5879516a57ea780e1cc88edaf2051e1d32915f` — the merge
commit of mitmproxy#4) is pinned in `Pipfile.lock`, preserving
reproducibility.

## Lockfile-level changes (re-lock side-effects, no Pipfile pin changes)

| Dep | Before | After | Reason |
|---|---|---|---|
| **mitmproxy** ref | `70bad9a3...` (==12.2.2) | `df5879516a...`
(==13.0.0.dev0) | Fork tracking `main` |
| **pyopenssl** | `==25.3.0` | **`==26.2.0`** | Cap lifted; fixes CVEs |
| asgiref | `==3.11.0` | `==3.11.1` | Latest within range |
| certifi | `==2026.2.25` | `==2026.5.20` | Latest within range |
| click | `==8.3.2` | `==8.4.1` | Latest within range |
| filelock | `==3.28.0` | `==3.29.0` | Latest within range |
| packaging | `==26.1` | `==26.2` | Latest within range |
| psycopg | `==3.3.3` | `==3.3.4` | Latest within range |
| pytest-asyncio | `==1.3.0` | `==1.4.0` | Latest within range |
| urwid | `==3.0.5` | `==4.0.0` | Allowed by mitmproxy main's relaxed
cap |
| wcwidth | `==0.6.0` | `==0.7.0` | Latest within range |

Per scope direction, no other direct deps were bumped — only the
security-driven `mitmproxy` ref change. Other transitive movements above
are natural consequences of `pipenv lock --clear` against unchanged
version constraints.

## Validation

```bash
$ cd src/test/regress
$ pipenv sync
Installing dependencies from Pipfile.lock (416d8f)...
All dependencies are now up-to-date!

$ pipenv run pip show mitmproxy pyopenssl | grep -E "^Name:|^Version:"
Name: mitmproxy
Version: 13.0.0.dev0
Name: pyOpenSSL
Version: 26.2.0
```

Both `src/test/regress/Pipfile.lock` and
`.devcontainer/src/test/regress/Pipfile.lock` are byte-identical, per
the convention established in #8488 and #8547.

## Notes
- Lockfiles regenerated with `pipenv lock --clear` (pipenv 2025.0.3,
Python 3.12.12).
- Currently-open Dependabot dependency-update bot PRs (#8525, #8526
pyasn1; #8489 werkzeug; #8510, #8511 black) target versions that the
existing lockfile already satisfies — they will auto-close on next
Dependabot scan without further action.
- Follow-up PR on `citusdata/the-process` will regenerate the three
`circleci/images/*/files/etc/requirements.txt` files (which are
generated from this `Pipfile.lock` via `pipenv requirements`) once this
lands.

Closes #123
Closes #124
Closes #125
Closes #126

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants