Skip to content

deps: bump requests to 2.33.0 in automation_test (fix PYSEC-2026-1872, PYSEC-2026-2275) - #11853

Open
katsugtgz wants to merge 1 commit into
deepflowio:mainfrom
katsugtgz:deps/requests-2.33.0
Open

deps: bump requests to 2.33.0 in automation_test (fix PYSEC-2026-1872, PYSEC-2026-2275)#11853
katsugtgz wants to merge 1 commit into
deepflowio:mainfrom
katsugtgz:deps/requests-2.33.0

Conversation

@katsugtgz

Copy link
Copy Markdown

Bumps requests from 2.32.3 to 2.33.0 in automation_test/requirements.txt.

Fixes:

  • PYSEC-2026-1872 (.netrc credentials leak via malicious URLs, fixed 2.32.4)
  • PYSEC-2026-2275 (fixed 2.33.0)

Local verification:

  • pip-audit before: requests 2.32.3 flagged with PYSEC-2026-1872, PYSEC-2026-2275
  • pip-audit after with this pin: no findings for requests
  • pip install -r automation_test/requirements.txt OK, socketio.Client() instantiates OK with requests 2.33.0

Note: python-socketio 5.8.0 has PYSEC-2026-1854 (fixed 5.14.0), left untouched to keep the diff minimal.

Signed-off-by: katsugtgz <206627023+katsugtgz@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants