From d5d4c9df7f5072f643ec027b0bc9e6989b2a50ae Mon Sep 17 00:00:00 2001 From: Simon Ramzi Date: Mon, 17 Aug 2026 12:16:20 +0000 Subject: [PATCH] [MGMT-358] Bump vulnerable urllib3, certifi, and pytest floors Addressed Datadog-flagged CVEs by raising the minimum resolvable version for each affected dependency (no lockfile in this repo, so the >= floors in requirements.txt/setup.py/test-requirements.txt are the only place these are pinned): - urllib3 >= 2.0.0 -> >= 2.7.0 Fixes CVE-2023-43804, CVE-2023-45803, CVE-2024-37891, CVE-2025-50181, CVE-2025-66471, CVE-2025-66418, CVE-2026-21441, CVE-2026-44431 - certifi >= 2023.7.22 -> >= 2024.7.4 Fixes CVE-2024-39689 (GLOBALTRUST root cert removal) - pytest >= 7.0 -> >= 9.0.3 Fixes CVE-2025-71176 (insecure tmpdir handling) Verified by installing requirements.txt + test-requirements.txt into a clean venv, confirming pip resolves urllib3 2.7.0, certifi 2026.7.22, and pytest 9.1.1 (all above the patched floors), and running `pytest --cov=adzerk_decision_sdk` (1 passed). Cross-checked each CVE against the urllib3/certifi/pytest upstream changelogs to confirm the chosen floor versions actually contain the fix. --- requirements.txt | 4 ++-- setup.py | 2 +- test-requirements.txt | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/requirements.txt b/requirements.txt index ef681f8..fa1dcc5 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,4 +1,4 @@ -certifi >= 2023.7.22 +certifi >= 2024.7.4 six >= 1.10 python_dateutil >= 2.8.2 -urllib3 >= 2.0.0 +urllib3 >= 2.7.0 diff --git a/setup.py b/setup.py index dd0e998..3bbae1f 100644 --- a/setup.py +++ b/setup.py @@ -15,7 +15,7 @@ # prerequisite: setuptools # http://pypi.python.org/pypi/setuptools -REQUIRES = ["urllib3 >= 2.0.0", "six >= 1.10", "certifi >= 2023.7.22", "python-dateutil >= 2.8.2"] +REQUIRES = ["urllib3 >= 2.7.0", "six >= 1.10", "certifi >= 2024.7.4", "python-dateutil >= 2.8.2"] setup( name=NAME, diff --git a/test-requirements.txt b/test-requirements.txt index e804c0a..99fe260 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -1,3 +1,3 @@ -pytest >= 7.0 +pytest >= 9.0.3 pytest-cov >= 4.0 pytest-randomly >= 3.12