From e4385040d73ce1122cc92f269761207d0133b2e2 Mon Sep 17 00:00:00 2001 From: Jeff Schnitter Date: Thu, 1 Oct 2026 16:06:22 -0700 Subject: [PATCH 1/2] fix: bump urllib3 to 2.8.0 to resolve CVE-2026-97687 and CVE-2026-97689 Co-Authored-By: Claude Sonnet 4.6 --- poetry.lock | 8 ++++---- pyproject.toml | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/poetry.lock b/poetry.lock index 0701c2d1..67b3778a 100644 --- a/poetry.lock +++ b/poetry.lock @@ -1099,14 +1099,14 @@ files = [ [[package]] name = "urllib3" -version = "2.7.0" +version = "2.8.0" description = "HTTP library with thread-safe connection pooling, file post, and more." optional = false python-versions = ">=3.10" groups = ["main", "dev", "playwright"] files = [ - {file = "urllib3-2.7.0-py3-none-any.whl", hash = "sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897"}, - {file = "urllib3-2.7.0.tar.gz", hash = "sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c"}, + {file = "urllib3-2.8.0-py3-none-any.whl", hash = "sha256:0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3"}, + {file = "urllib3-2.8.0.tar.gz", hash = "sha256:63bf2ead4c879426ebf22ef2a781eeb4aa3b4ae798a0435506f8687fd5bb9b63"}, ] [package.extras] @@ -1118,4 +1118,4 @@ zstd = ["backports-zstd (>=1.0.0) ; python_version < \"3.14\""] [metadata] lock-version = "2.1" python-versions = "^3.11" -content-hash = "a33f8151f2743a1985772b305babc1a056f9bc397278e90e53f4ec8ec134e163" +content-hash = "31a1cf0b8d18d08a63b23ace0ce0851511c4382e397288617a1dfed0a678a36b" diff --git a/pyproject.toml b/pyproject.toml index 008ef747..c1d5946a 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -19,7 +19,7 @@ classifiers = [ python = "^3.11" requests = "^2.33.0" pyyaml = ">= 6.0.1, < 7" -urllib3 = ">= 2.7.0" +urllib3 = ">= 2.8.0" typer = ">=0.15,<1.0" typing_extensions = ">=3.7.4.3" PyNaCl = ">=1.5.0" From ffef5701f73ce04e8362347ae407c1ebabde09cc Mon Sep 17 00:00:00 2001 From: Jeff Schnitter Date: Fri, 2 Oct 2026 09:06:24 -0700 Subject: [PATCH 2/2] chore: trigger CI