From 18bb4592af62d0a1e9f17f1b4c9fc07c59bb9c78 Mon Sep 17 00:00:00 2001 From: Loren Phillips Date: Fri, 22 May 2026 11:58:10 -0700 Subject: [PATCH 1/2] fix(deps): bump urllib3 to 2.7.0 Patches GHSA-pq67-6m6q-mj2v: urllib3 < 2.7.0 forwards sensitive headers across origins during proxied low-level redirects. Resolves Dependabot alert #9. --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 9ee2289..1f39623 100644 --- a/requirements.txt +++ b/requirements.txt @@ -2,4 +2,4 @@ certifi==2024.8.30 charset-normalizer==3.4.0 idna==3.10 requests==2.32.3 -urllib3==2.2.3 +urllib3==2.7.0 From ed13b8c84791bd942eae27edc80365b2a59c7ed2 Mon Sep 17 00:00:00 2001 From: Loren Phillips Date: Fri, 22 May 2026 11:58:17 -0700 Subject: [PATCH 2/2] fix(deps): bump idna to 3.15 Patches the IDNA bypass of the CVE-2024-3651 fix: specially crafted inputs to idna.encode() can still trigger pathological CPU usage on idna < 3.15. Resolves Dependabot alert #10. --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 1f39623..09dd0fa 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,5 +1,5 @@ certifi==2024.8.30 charset-normalizer==3.4.0 -idna==3.10 +idna==3.15 requests==2.32.3 urllib3==2.7.0