diff --git a/.github/workflows/publish.pypi.sdk.storage.oracle.kms.yml b/.github/workflows/publish.pypi.sdk.storage.oracle.kms.yml index ef7a24707..f0116063b 100644 --- a/.github/workflows/publish.pypi.sdk.storage.oracle.kms.yml +++ b/.github/workflows/publish.pypi.sdk.storage.oracle.kms.yml @@ -35,7 +35,7 @@ jobs: runs-on: ubuntu-latest strategy: matrix: - python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"] + python-version: ["3.10", "3.11", "3.12", "3.13"] defaults: run: working-directory: ./sdk/python/storage/keeper_secrets_manager_storage_oracle_kms @@ -182,10 +182,10 @@ jobs: with: persist-credentials: false - - name: Set up Python 3.9 + - name: Set up Python 3.10 uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: - python-version: '3.9' + python-version: '3.10' - name: Install build tools run: | diff --git a/.github/workflows/test.python.storage.oracle.kms.yml b/.github/workflows/test.python.storage.oracle.kms.yml index c7f345f84..fccd3dce8 100644 --- a/.github/workflows/test.python.storage.oracle.kms.yml +++ b/.github/workflows/test.python.storage.oracle.kms.yml @@ -22,7 +22,7 @@ jobs: runs-on: ubuntu-latest strategy: matrix: - python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"] + python-version: ["3.10", "3.11", "3.12", "3.13"] defaults: run: working-directory: ./sdk/python/storage/keeper_secrets_manager_storage_oracle_kms diff --git a/sdk/python/storage/keeper_secrets_manager_storage_oracle_kms/README.md b/sdk/python/storage/keeper_secrets_manager_storage_oracle_kms/README.md index 5fc7afa16..5d713cdd9 100644 --- a/sdk/python/storage/keeper_secrets_manager_storage_oracle_kms/README.md +++ b/sdk/python/storage/keeper_secrets_manager_storage_oracle_kms/README.md @@ -102,6 +102,15 @@ Once setup, the Secrets Manager Oracle KMS integration supports all Secrets Mana ## Change Log +### 1.1.1 + +**Requirements:** +- Minimum Python version raised to 3.10 (`urllib3>=2.7.0` requires Python 3.10+); users on Python 3.9 should pin to `<1.1.1` +- `oci` Python 3.9 split constraint removed; minimum is now `oci>=2.174.0` unconditionally + +**Security:** +- **KSM-1022:** Fixed CVE-2026-44431; upgraded `urllib3` to 2.7.0. Versions before 2.7.0 forward `Authorization` and `Cookie` headers across origins when following redirects via the low-level `assert_same_host=False` code path (CVSS High) + ### 1.1.0 **Requirements:** diff --git a/sdk/python/storage/keeper_secrets_manager_storage_oracle_kms/pyproject.toml b/sdk/python/storage/keeper_secrets_manager_storage_oracle_kms/pyproject.toml index f055ce3b2..7727dde26 100644 --- a/sdk/python/storage/keeper_secrets_manager_storage_oracle_kms/pyproject.toml +++ b/sdk/python/storage/keeper_secrets_manager_storage_oracle_kms/pyproject.toml @@ -4,10 +4,10 @@ build-backend = "setuptools.build_meta" [project] name = "keeper-secrets-manager-storage-oracle-kms" -version = "1.1.0" +version = "1.1.1" description = "Keeper Secrets Manager SDK storage integration with Oracle Cloud KMS for encrypted key-value storage." readme = "README.md" -requires-python = ">=3.9.2" +requires-python = ">=3.10" license = {file = "LICENSE"} authors = [ {name = "Keeper Security", email = "sm@keepersecurity.com"}, @@ -30,7 +30,6 @@ classifiers = [ "Operating System :: OS Independent", "Programming Language :: Python", "Programming Language :: Python :: 3", - "Programming Language :: Python :: 3.9", "Programming Language :: Python :: 3.10", "Programming Language :: Python :: 3.11", "Programming Language :: Python :: 3.12", @@ -40,12 +39,7 @@ classifiers = [ ] dependencies = [ "keeper-secrets-manager-core>=17.2.1", - # oci pins urllib3==1.26.x on Python 3.9 starting in 2.168.2, which conflicts - # with keeper-secrets-manager-core's urllib3>=2.6.3. On 3.10+, oci uses urllib3>=2.6.3 - # so we can pull the latest. 2.167.3 is the oldest oci that allows cryptography>=46.0.5 - # (needed for CVE-2026-26007); earlier oci versions cap cryptography<46.0.0. - "oci>=2.167.3,<2.168.2 ; python_version < '3.10'", - "oci>=2.174.0 ; python_version >= '3.10'", + "oci>=2.174.0", "pycryptodome>=3.21.0", "requests>=2.32.0", "cryptography>=46.0.5", diff --git a/sdk/python/storage/keeper_secrets_manager_storage_oracle_kms/requirements.txt b/sdk/python/storage/keeper_secrets_manager_storage_oracle_kms/requirements.txt index 998df4de7..1151ff6f8 100644 --- a/sdk/python/storage/keeper_secrets_manager_storage_oracle_kms/requirements.txt +++ b/sdk/python/storage/keeper_secrets_manager_storage_oracle_kms/requirements.txt @@ -1,5 +1,5 @@ # This file was autogenerated by uv via the following command: -# uv pip compile pyproject.toml --python-version 3.9 --universal -o requirements.txt +# uv pip compile pyproject.toml --python-version 3.10 --universal -o requirements.txt certifi==2025.1.31 # via # oci @@ -20,17 +20,13 @@ idna==3.10 # via requests keeper-secrets-manager-core==17.2.1 # via keeper-secrets-manager-storage-oracle-kms (pyproject.toml) -oci==2.168.1 ; python_full_version < '3.10' - # via keeper-secrets-manager-storage-oracle-kms (pyproject.toml) -oci==2.174.0 ; python_full_version >= '3.10' +oci==2.174.0 # via keeper-secrets-manager-storage-oracle-kms (pyproject.toml) pycparser==2.22 ; implementation_name != 'PyPy' and platform_python_implementation != 'PyPy' # via cffi pycryptodome==3.21.0 # via keeper-secrets-manager-storage-oracle-kms (pyproject.toml) -pyopenssl==25.3.0 ; python_full_version < '3.10' - # via oci -pyopenssl==26.2.0 ; python_full_version >= '3.10' +pyopenssl==26.2.0 # via oci python-dateutil==2.9.0.post0 # via oci @@ -46,7 +42,7 @@ typing-extensions==4.15.0 ; python_full_version < '3.13' # via # cryptography # pyopenssl -urllib3==2.6.3 +urllib3==2.7.0 # via # keeper-secrets-manager-core # oci