chore(deps): bump httplib2 from 0.19.1 to 0.32.0 - #6054
Conversation
Bumps [httplib2](https://github.com/httplib2/httplib2) from 0.19.1 to 0.32.0. - [Changelog](https://github.com/httplib2/httplib2/blob/master/CHANGELOG) - [Commits](httplib2/httplib2@v0.19.1...v0.32.0) --- updated-dependencies: - dependency-name: httplib2 dependency-version: 0.32.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
🔵 Review postedLast updated: 2026-07-28 05:19 UTC |
rtibblesbot
left a comment
rtibblesbot
left a comment
There was a problem hiding this comment.
PR #6054 — httplib2 0.19.1 → 0.32.0 (production, transitive via django-postmark), plus transitive pyparsing 2.4.7 → 3.3.2.
Semver risk: minor by version number, but a 13-release span; the pyparsing bump is a major.
Security fix (the reason to merge): CVE-2026-59939 / GHSA-j5g9-f88f-gfj3 — unbounded decompression of gzip/deflate response bodies lets a hostile server OOM the client with a ~150 KB payload. Affected range [0, 0.32.0), so the current 0.19.1 pin is vulnerable and 0.32.0 is the fix.
Breaking changes: 0.30.0 drops Python < 3.7, 0.32.0 drops < 3.8 — runtime.txt pins 3.10.13 and CI uses 3.10, so both are satisfied. 0.31.2 raises the floor to pyparsing>=3.1 (pp.DelimitedList), which is why pyparsing jumps a major; httplib2 is its only consumer in this dep set (requirements.txt:236 — # via httplib2), and pyparsing<4,>=3.1 is satisfied.
Behavior change to note: 0.32.0's decompression limits are on by default, not opt-in — LimitDecoder uses ratio=100, safe_limit=10 MiB, hard_limit=10 GiB. A response fails only if it exceeds 10 MiB and amplifies >100×. Postmark API JSON is nowhere near that.
Compatibility: no code changes required. Nothing in contentcuration/ imports httplib2 or pyparsing. httplib2 is reachable only via postmark/backends.py, which Studio doesn't use — settings point EMAIL_BACKEND at postmark.django_backend.EmailBackend (python-postmark), which goes through urllib.request. Real CVE exposure is effectively nil; merge on hygiene grounds rather than urgency.
CI: passing (Python unit tests, linting, browser smoke test, frontend build).
The google-api-core[grpc] / googleapis-common-protos[grpc] extras markers are pip-tools regeneration noise, not part of the httplib2 change — see the inline note.
@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly
How was this generated?
Ran a dependency-update review pipeline over the version bump:
- Classified the bump by semver (patch / minor / major) and dependency type (production vs. development)
- Extracted the changelog and release notes across the version range
- Assessed compatibility with this project's usage and whether any code changes are required
- Treated CI as the primary safety net
- Scaled the review depth to the update's risk
- Chose the verdict from semver risk, changelog findings, and CI status
| exceptiongroup==1.3.1 | ||
| # via celery | ||
| google-api-core==2.30.0 | ||
| google-api-core[grpc]==2.30.0 |
There was a problem hiding this comment.
nitpick: These [grpc] extras markers (here and at line 140) are pip-tools regeneration artifacts, not consequences of the httplib2 bump. They're inert — grpcio, grpcio-status, and grpc-google-iam-v1 are already pinned as explicit lines on unstable, so the install set is unchanged (4 insertions / 4 deletions, no new entries). The annotation is just more accurate about why those grpc pins exist. Nothing to fix.
1 participant
Bumps httplib2 from 0.19.1 to 0.32.0.
Changelog
Sourced from httplib2's changelog.
... (truncated)
Commits
ba9bf50v0.32.0 release87581addecompression limited by size and ratio; require python 3.8+a99a11fv0.31.2 release370010adep-compat: pp.DelimitedList (camel case) only available in pyparsing>=3.16d2ea32v0.31.1 released1b0ce3auth: use pyparsing v3 PEP8-compliant method names3288ba7chore: harden publishing. use github attestations26cfea5v0.31.0 releasecbd3d21chore: CI use trusted publishing147d7d5https: avoid costly load_verify_locations when SSL certificate validation is ...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.