From 10e3b67e9b22f48dc809501acc67a9e6cf4e8cc5 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 1 Oct 2026 11:12:40 +0000 Subject: [PATCH 1/2] ci: bump the github-actions group with 4 updates Bumps the github-actions group with 4 updates: [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action), [docker/build-push-action](https://github.com/docker/build-push-action), [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) and [actions/deploy-pages](https://github.com/actions/deploy-pages). Updates `docker/setup-buildx-action` from 4.3.0 to 4.4.1 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/37fe631027851001ddb9b187196cc803df7f5f0e...f87e5991a6d7451dcb8d9637bfbc97413f497069) Updates `docker/build-push-action` from 7.3.0 to 7.4.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](https://github.com/docker/build-push-action/compare/53b7df96c91f9c12dcc8a07bcb9ccacbed38856a...c3c9e263c25d99ce0380d002d59b67737d91b0dc) Updates `astral-sh/setup-uv` from 10.0.1 to 10.2.0 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](https://github.com/astral-sh/setup-uv/compare/20cfd1bf945f4377ade1205e4dbc17946fc9a30d...c18668ad3cf93ea998bef934396af7bb5c839dc7) Updates `actions/deploy-pages` from 5.0.0 to 5.0.1 - [Release notes](https://github.com/actions/deploy-pages/releases) - [Commits](https://github.com/actions/deploy-pages/compare/cd2ce8fcbc39b97be8ca5fce6e763baed58fa128...368f82528645a54fb793d4d04e342629a3f51346) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-version: 4.4.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: docker/build-push-action dependency-version: 7.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: astral-sh/setup-uv dependency-version: 10.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/deploy-pages dependency-version: 5.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/docker-publish.yml | 6 +++--- .github/workflows/graph-pages.yml | 4 ++-- .github/workflows/security.yml | 8 ++++---- .github/workflows/tests.yml | 4 ++-- 4 files changed, 11 insertions(+), 11 deletions(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 150a8652..216affc0 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -60,7 +60,7 @@ jobs: echo "IMAGE_REF=${REGISTRY}/${GITHUB_REPOSITORY,,}" >> "$GITHUB_ENV" - name: Set up Docker Buildx - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4 - name: Log in to Container Registry uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 @@ -82,7 +82,7 @@ jobs: - name: Build immutable native candidate id: build - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7 with: context: . platforms: linux/${{ matrix.arch }} @@ -185,7 +185,7 @@ jobs: echo "IMAGE_REF=${REGISTRY}/${GITHUB_REPOSITORY,,}" >> "$GITHUB_ENV" - name: Set up Docker Buildx - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4 - name: Log in to Container Registry uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 diff --git a/.github/workflows/graph-pages.yml b/.github/workflows/graph-pages.yml index 075362d3..546e69ca 100644 --- a/.github/workflows/graph-pages.yml +++ b/.github/workflows/graph-pages.yml @@ -20,7 +20,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 with: version: '0.12.3' @@ -82,5 +82,5 @@ jobs: name: github-pages url: ${{ steps.deployment.outputs.page_url }} steps: - - uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5 + - uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5 id: deployment diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index b6aab592..f14a820b 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -35,10 +35,10 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4 - name: Build AMD64 scan candidate - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7 with: context: . platforms: linux/amd64 @@ -95,10 +95,10 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4 - name: Build ARM64 scan candidate - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7 with: context: . platforms: linux/arm64 diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index d56cfde7..8bbc1667 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -73,7 +73,7 @@ jobs: python-version: '3.11' - name: Set up uv - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 with: version: '0.12.3' @@ -536,7 +536,7 @@ jobs: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4 - name: Exercise immutable promotion against a disposable local registry run: python scripts/check_release_promotion.py From db9ecdf3c2125265a175c89ac84a870de930a16c Mon Sep 17 00:00:00 2001 From: bifrost0x Date: Fri, 2 Oct 2026 20:21:25 +0200 Subject: [PATCH 2/2] ci: align action pin policy and update urllib3 security floor --- requirements-test.txt | 10 ++++++---- requirements.in | 2 ++ requirements.txt | 10 ++++++---- tests/test_dependency_policy.py | 6 ++++++ tests/test_supply_chain_policy.py | 10 +++++----- 5 files changed, 25 insertions(+), 13 deletions(-) diff --git a/requirements-test.txt b/requirements-test.txt index 0636e4f7..c04a6a44 100644 --- a/requirements-test.txt +++ b/requirements-test.txt @@ -887,10 +887,12 @@ typing-extensions==4.16.0 \ # via # pyopenssl # sqlalchemy -urllib3==2.7.0 \ - --hash=sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c \ - --hash=sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897 - # via requests +urllib3==2.8.0 \ + --hash=sha256:0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3 \ + --hash=sha256:63bf2ead4c879426ebf22ef2a781eeb4aa3b4ae798a0435506f8687fd5bb9b63 + # via + # -r requirements.in + # requests webauthn==3.0.0 \ --hash=sha256:324e54e1f6eeef486623b5d90df6fcd74ae04ff0c137d2b818a8f709b6ca3ab8 \ --hash=sha256:b5d0c02b6efa16be683f8a75abd2073f5e59a15f42623cc22c31f27600259e64 diff --git a/requirements.in b/requirements.in index 9e03c62a..436e74da 100644 --- a/requirements.in +++ b/requirements.in @@ -32,6 +32,8 @@ qrcode>=8.2,<9 Authlib>=1.8.0,<2 # Compatibility: Authlib's Flask client uses the reviewed Requests 2.x transport API. requests>=2.34,<3 +# Compatibility: Requests 2.x supports urllib3 2.x; 2.8.0 fixes proxy TLS and chunk parsing vulnerabilities. +urllib3>=2.8.0,<3 # Compatibility: Bonsai 1.5.5 supports Python 3.10-3.14 and exposes the # reviewed OpenLDAP StartTLS, certificate-policy, timeout, and referral APIs. bonsai==1.5.5 diff --git a/requirements.txt b/requirements.txt index 279aa968..85a5c875 100644 --- a/requirements.txt +++ b/requirements.txt @@ -856,10 +856,12 @@ typing-extensions==4.16.0 \ # via # pyopenssl # sqlalchemy -urllib3==2.7.0 \ - --hash=sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c \ - --hash=sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897 - # via requests +urllib3==2.8.0 \ + --hash=sha256:0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3 \ + --hash=sha256:63bf2ead4c879426ebf22ef2a781eeb4aa3b4ae798a0435506f8687fd5bb9b63 + # via + # -r requirements.in + # requests webauthn==3.0.0 \ --hash=sha256:324e54e1f6eeef486623b5d90df6fcd74ae04ff0c137d2b818a8f709b6ca3ab8 \ --hash=sha256:b5d0c02b6efa16be683f8a75abd2073f5e59a15f42623cc22c31f27600259e64 diff --git a/tests/test_dependency_policy.py b/tests/test_dependency_policy.py index 99220358..67f0d17f 100644 --- a/tests/test_dependency_policy.py +++ b/tests/test_dependency_policy.py @@ -197,6 +197,12 @@ def test_runtime_locks_exclude_vulnerable_cryptography_versions(path): assert locked_version(path, "cryptography") >= Version("50.0.0") +@pytest.mark.parametrize("path", ["requirements.txt", "requirements-test.txt"]) +def test_runtime_locks_exclude_vulnerable_urllib3_versions(path): + """CVE-2026-97687 and CVE-2026-97689 affect urllib3 before 2.8.0.""" + assert locked_version(path, "urllib3") >= Version("2.8.0") + + @pytest.mark.parametrize("path", ["requirements.txt", "requirements-test.txt"]) def test_runtime_locks_include_reviewed_mfa_libraries(path): """TOTP verification and local SVG provisioning require reviewed APIs.""" diff --git a/tests/test_supply_chain_policy.py b/tests/test_supply_chain_policy.py index 7d01bf8a..99ecbaf4 100644 --- a/tests/test_supply_chain_policy.py +++ b/tests/test_supply_chain_policy.py @@ -20,7 +20,7 @@ 'v8.0.1', ), 'actions/deploy-pages': ( - 'cd2ce8fcbc39b97be8ca5fce6e763baed58fa128', + '368f82528645a54fb793d4d04e342629a3f51346', 'v5', ), 'actions/setup-node': ( @@ -48,11 +48,11 @@ 'v0.36.0', ), 'astral-sh/setup-uv': ( - '20cfd1bf945f4377ade1205e4dbc17946fc9a30d', - 'v10.0.1', + 'c18668ad3cf93ea998bef934396af7bb5c839dc7', + 'v10.2.0', ), 'docker/build-push-action': ( - '53b7df96c91f9c12dcc8a07bcb9ccacbed38856a', + 'c3c9e263c25d99ce0380d002d59b67737d91b0dc', 'v7', ), 'docker/login-action': ( @@ -64,7 +64,7 @@ 'v6', ), 'docker/setup-buildx-action': ( - '37fe631027851001ddb9b187196cc803df7f5f0e', + 'f87e5991a6d7451dcb8d9637bfbc97413f497069', 'v4', ), 'docker/setup-qemu-action': (