Repository navigation
fix!: bump urllib3, pytest, filelock and require Python 3.10+ (dependency vulnerability fixes) - #23
Open
devin-ai-integration[bot] wants to merge 3 commits into
Conversation
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Author
|
I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".
|
…-pkg/urllib3-a66e4043/2026-10-05 Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dependency vulnerability fixes (automated)
Generated by the Devin Dependency Security Vuln Fix automation run on 2026-11-02 (PR originally opened 2026-10-05).
Change type: Major version bump — includes source/config changes to adapt to a breaking change.
Warning
We're not just looking for a review like a normal PR. Security can offer this fix as a recommendation, but doesn't have the tooling or domain knowledge to safely verify changes like this end-to-end for each repo. Please review, test, and own deployment before merging. For more information: https://launchdarkly.atlassian.net/wiki/spaces/SEC/pages/5360943572/Dependency+Vulnerability+Remediation+with+Devin.
Findings addressed
Breaking change for consumers (hence
fix!:): every patched release above (urllib3 2.7.0/2.8.0, pytest 9.0.3, filelock 3.20.3) declaresRequires-Python >=3.10, so the package's supported-Python floor is raised 3.9 → 3.10 (Python 3.9 is upstream EOL):pyproject.tomlrequires-pythonandsetup.pyPYTHON_REQUIRES:>=3.9→>=3.10.github/workflows/python.ymlmatrix: dropped3.9README.md: "Python 3.9+" → "Python 3.10+"requirements.txt/test-requirements.txt/pyproject.tomldev group mirror the new floors (filelock >= 3.20.3added explicitly).2026-10-26: merged
main(generated release 25.0.0). The only conflict wassetup.py; resolved toVERSION = "25.0.0"(frommain) +PYTHON_REQUIRES = ">= 3.10"(this PR). The PR diff vsmainis still 6 files / +11 −9. The 25.0.0 regeneration reverted nothing else, but confirms the generator note: these files come from openapi-generator inld-openapi; unless the generator config there is updated (Python floor + dependency floors), future releases will keep conflicting with / reverting this change.2026-11-02 update: branch current with
main; urllib3 floor raised>=2.7.0→>=2.8.0inrequirements.txt,setup.pyandpyproject.toml(the 2.8.0 advisories are now past the 7-day hold).Deferred / excluded findings
.travis.yml/.gitlab-ci.ymlstill list Python 3.9; they are generator boilerplate not used by this repo's CI (GitHub Actions) and are left untouched.Verification
pip install -r requirements.txt -r test-requirements.txt && pip install -e .+pip checkon Python 3.10 (resolved urllib3 2.8.0, pytest 9.2.0, filelock 4.1.0)pip install -e .builds the package)pytest— 1122 passed on 3.10 (2026-11-02)flake8 launchdarkly_api --select=E9,F63,F7,F82— 0 issues (CI does not run a linter)Note
Overview
Security-driven dependency remediation with a breaking supported-Python change: the package now requires Python 3.10+ (
pyproject.toml,setup.py, README), and GitHub Actions no longer tests 3.9.Runtime
urllib3is raised from>=2.1.0to>=2.8.0inrequirements.txt,setup.py, andpyproject.toml. Dev tooling floors move topytest >= 9.0.3and add an explicitfilelock >= 3.20.3inpyproject.toml/test-requirements.txt. No application or client library source changes—only install metadata, docs, and CI matrix.Reviewed by Cursor Bugbot for commit 4e2ef5c. Bugbot is set up for automated code reviews on this repo. Configure here.
Link to Devin session: https://app.devin.ai/sessions/8fbccb467dd4402f85e12e5f1613065c
Open in Devin Desktop: https://app.devin.ai/desktop/session/8fbccb467dd4402f85e12e5f1613065c?variant=devin