From 3a3feb38fb45adf7a8aa1c20edf5221a09bd7cfd Mon Sep 17 00:00:00 2001 From: Bill Hamilton Date: Fri, 2 Oct 2026 09:51:21 -0700 Subject: [PATCH] security(pip): pin black 26.3.1, urllib3 2.8.0, requests 2.34.2 in dev requirements requirements.txt is the README's dev-setup file. tox.ini and pyproject.toml are unchanged, so the published package and its Python >=3.8 support are unaffected. The new pins need Python >=3.10 for local dev setup. - black (unpinned, resolved by Snyk to 23.3.0) -> 26.3.1 - urllib3 2.6.3 -> 2.8.0 (2.7.0 fixes the ticketed highs; 2.8.0 also fixes SNYK-PYTHON-URLLIB3-20302844/-45/-46) - requests 2.32.4 -> 2.34.2 (SNYK-PYTHON-REQUESTS-15763443, fixed in 2.33.0) - example.py: black 26 formatting. The Lint workflow installs unpinned black, so without this, Lint fails on the next PR. Snyk (requirements.txt): 6 issues -> 0. Co-Authored-By: Claude Opus 5.5 --- example.py | 6 ++---- requirements.txt | 6 +++--- 2 files changed, 5 insertions(+), 7 deletions(-) diff --git a/example.py b/example.py index d37d7cc..9e3da94 100644 --- a/example.py +++ b/example.py @@ -23,10 +23,8 @@ try: secret = secret_server_cloud.get_secret(os.getenv("TSS_SECRET_ID")) serverSecret = ServerSecret(**secret) - print( - f"""username: {serverSecret.fields['username'].value} + print(f"""username: {serverSecret.fields['username'].value} password: {serverSecret.fields['password'].value} - template: {serverSecret.secret_template_name}""" - ) + template: {serverSecret.secret_template_name}""") except SecretServerError as error: print(error.response.text) diff --git a/requirements.txt b/requirements.txt index 3f6a39b..16b1a8d 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,8 +1,8 @@ -requests==2.32.4 +requests==2.34.2 tox pytest python-dotenv flit -black -urllib3==2.6.3 # not directly required, pinned by Snyk to avoid a vulnerability +black==26.3.1 +urllib3==2.8.0 # not directly required, pinned by Snyk to avoid a vulnerability zipp==3.23.0 # not directly required, pinned by Snyk to avoid a vulnerability