chore: resolve open dependabot security alerts - #399
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates dependencies in the uv.lock file, upgrading aiohttp from 3.13.5 to 3.14.1 along with its corresponding wheels and a conditional dependency on typing-extensions. Additionally, openfeature-provider-flagd is upgraded from 0.4.1 to 0.5.0. As there are no review comments, no further feedback is provided.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #399 +/- ##
==========================================
+ Coverage 95.54% 96.23% +0.69%
==========================================
Files 24 47 +23
Lines 1033 1754 +721
==========================================
+ Hits 987 1688 +701
- Misses 46 66 +20 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
📝 WalkthroughWalkthroughThe flagd provider’s Hatch protobuf build hook now requires protobuf 7.x and pins grpcio-tools to version 1.82.1, aligning build-time tooling with the configured runtime dependencies. ChangesProtobuf tooling alignment
Estimated code review effort: 1 (Trivial) | ~3 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
…ntime Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
grpcio-tools 1.82+ dropped protobuf 6.x support and now requires protobuf>=7.35.1,<8.0.0, so the isolated build hook's protobuf pin must track the runtime protobuf constraint instead of staying on ~=6.0 (see #400 for why it was pinned there originally). Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
ec72952 to
68992aa
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@providers/openfeature-provider-flagd/pyproject.toml`:
- Around line 50-62: Align the runtime dependency constraints with
grpcio-tools==1.82.1 by raising the protobuf floor to >=7.35.1 and the grpcio
floor to >=1.82.1 in the corresponding runtime dependency declarations. Keep the
existing upper bounds and ensure the build-tool and runtime versions remain
compatible.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 0c5fd530-a96a-4abb-961c-5ddb8a9411bc
⛔ Files ignored due to path filters (1)
uv.lockis excluded by!**/*.lock
📒 Files selected for processing (1)
providers/openfeature-provider-flagd/pyproject.toml
| # protobuf here used to stay pinned to ~=6.0 because grpcio-tools only | ||
| # supported protobuf 7 in pre-releases (see #400). grpcio-tools >=1.82 | ||
| # now requires protobuf>=7.35.1,<8.0.0, so this is aligned with the | ||
| # runtime `protobuf` dependency above instead. | ||
| "protobuf>=7.0.0,<8.0.0", | ||
| "hatch-protobuf", | ||
| "mypy-protobuf~=3.0", | ||
| # Pin grpcio-tools to the same version as the runtime `grpcio` dependency | ||
| # above. hatch-protobuf otherwise resolves grpcio-tools unpinned in an | ||
| # isolated build environment, so newer grpcio-tools releases can generate | ||
| # gRPC stubs that are incompatible with the pinned runtime grpcio, | ||
| # breaking mypy/import at build time. | ||
| "grpcio-tools==1.82.1", |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
python - <<'PY'
import json
import urllib.request
url = "https://pypi.org/pypi/grpcio-tools/1.82.1/json"
with urllib.request.urlopen(url) as response:
metadata = json.load(response)
for requirement in metadata["info"].get("requires_dist", []):
if requirement.lower().startswith("protobuf"):
print(requirement)
PY
rg -n 'grpcio|protobuf|grpcio-tools' providers/openfeature-provider-flagd/pyproject.tomlRepository: open-feature/python-sdk-contrib
Length of output: 2798
🌐 Web query:
PyPI grpcio-tools 1.82.1 requires dist protobuf grpcio
💡 Result:
The Python package grpcio-tools version 1.82.1, released on July 8, 2026, has specific dependency requirements enforced via PyPI [1][2][3]. To install or use this version, the following packages must be met: - protobuf: Version >= 7.35.1 and < 8.0.0 [1]. (Note: This reflects an update in this release, which raised the lower bound from 6.33.5 [2][3].) - grpcio: Version >= 1.82.1 [1]. - setuptools: Version >= 77.0.1 [1]. These constraints ensure compatibility with the gRPC Core 1.82.1 release [2][3]. If you are encountering dependency resolution errors, ensure that your environment's package manager is satisfying these specific version ranges [1].
Citations:
- 1: https://pypi.org/project/grpcio-tools/1.82.1/
- 2: https://newreleases.io/project/pypi/grpcio-tools/release/1.82.1
- 3: https://github.com/grpc/grpc/releases/tag/v1.82.1
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '--- pyproject dependency snippets ---\n'
rg -n -C 3 '"grpcio|protobuf|grpcio-tools|hatch-protobuf|mypy-protobuf' providers/openfeature-provider-flagd/pyproject.toml || true
printf '\n--- check generated proto imports using local package metadata text ---\n'
# Read-only scan; print Python import-like snippets around generated proto code if present.
fd -a '\.py$' providers/openfeature-provider-flagd | sed 's#^\./##' | while read -r file; do
if rg -q 'protobuf|grpc|protobuf_reflection|google/protobuf' "$file"; then
printf '\nFILE: %s\n' "$file"
rg -n -C 2 'from google|import google|protobuf|grpc' "$file" | head -80
fi
doneRepository: open-feature/python-sdk-contrib
Length of output: 260
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- pyproject dependency snippets ---'
rg -n -C 3 '"grpcio|protobuf|grpcio-tools|hatch-protobuf|mypy-protobuf' providers/openfeature-provider-flagd/pyproject.toml || true
printf '%s\n' ''
printf '%s\n' '--- check generated proto imports using local package metadata text ---'
fd -a '\.py$' providers/openfeature-provider-flagd | sed 's#^\./##' | while read -r file; do
if rg -q 'protobuf|grpc|protobuf_reflection|google/protobuf' "$file"; then
printf '%s\n' ""
printf '%s\n' "FILE: $file"
rg -n -C 2 'from google|import google|protobuf|grpc' "$file" | head -80
fi
doneRepository: open-feature/python-sdk-contrib
Length of output: 13398
Align the runtime dependency floors with the build toolchain.
grpcio-tools==1.82.1 requires protobuf >=7.35.1,<8.0.0 and grpcio >=1.82.1, but the runtime metadata still allows protobuf >=7.0.0,<8.0.0 and grpcio >=1.81.0. Either raise/pin those runtime floors, or verify generated flagd gRPC modules import and pass tests across every allowed metadata version.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@providers/openfeature-provider-flagd/pyproject.toml` around lines 50 - 62,
Align the runtime dependency constraints with grpcio-tools==1.82.1 by raising
the protobuf floor to >=7.35.1 and the grpcio floor to >=1.82.1 in the
corresponding runtime dependency declarations. Keep the existing upper bounds
and ensure the build-tool and runtime versions remain compatible.
Summary
uv.lock.aiohttpto 3.14.1 (resolves 11 alerts, chore: add CODEOWNERS #34-ModuleNotFoundError when importing flagd provider #44).cryptographyto 49.0.0 (resolves 1 high-severity alert, fix: include proto file in build for openfeature-provider-flagd #45).grpcio/grpcio-health-checkingto 1.82.1 and the isolated build-timegrpcio-toolspin to match, since the runtimegrpcio>=1.81.0constraint had drifted ahead of the previously-pinnedgrpcio-tools, which generates gRPC stubs incompatible with the runtime version at import time (breaking the flagd provider test job).protobufpin (used only by the isolated Hatch protobuf build hook) from~=6.0to>=7.0.0,<8.0.0, matching the runtime constraint.grpcio-tools>=1.82dropped protobuf 6.x support entirely and now requires protobuf 7.35+, so the old 6.x pin (originally added in chore(deps): bump protobuf to 7.35.1 #400 to work around grpcio-tools' pre-release-only protobuf 7 support) no longer resolves.All changes are to transitive dependencies.
aiohttpandgrpciocome in via the provider packages;cryptographyviamoto/aiobotocoreinopenfeature-provider-aws-ssm's dev group. The lockfile was regenerated withuv lock --upgrade-package <pkg>. Verifieduv build,mypy,ruff, and the affected package test suites (flagd, aws-ssm) on the patched versions.Dependabot Alerts Resolved
aiohttpaiohttpaiohttpaiohttpaiohttpaiohttpaiohttpaiohttpaiohttpaiohttpaiohttpcryptography