Skip to content

chore: resolve open dependabot security alerts #399

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jonathannorris wants to merge 6 commits into
base: main
Choose a base branch
from
+239 −215
Open

chore: resolve open dependabot security alerts #399

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
904bdf1
chore: resolve open dependabot security alerts
jonathannorris Jun 8, 2026
93d815d
chore: bump cryptography to 49.0.0 to resolve dependabot alert #45
jonathannorris Jun 22, 2026
5788049
chore: bump grpcio to 1.81.1 to match generated grpc code
jonathannorris Jun 22, 2026
7c1d869
chore: pin grpcio-tools to match runtime grpcio version
jonathannorris Jul 6, 2026
ed39557
chore: bump pinned grpcio-tools to 1.82.1 to match relocked grpcio ru…
jonathannorris Jul 20, 2026
68992aa
chore: align build-time protobuf pin with grpcio-tools 1.82 requirement
jonathannorris Jul 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 11 additions & 1 deletion providers/openfeature-provider-flagd/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,9 +47,19 @@ dev = [
[tool.hatch.build.hooks.protobuf]
generate_pyi = false
dependencies = [
"protobuf~=6.0",
# protobuf here used to stay pinned to ~=6.0 because grpcio-tools only
# supported protobuf 7 in pre-releases (see #400). grpcio-tools >=1.82
# now requires protobuf>=7.35.1,<8.0.0, so this is aligned with the
# runtime `protobuf` dependency above instead.
"protobuf>=7.0.0,<8.0.0",
"hatch-protobuf",
"mypy-protobuf~=3.0",
# Pin grpcio-tools to the same version as the runtime `grpcio` dependency
# above. hatch-protobuf otherwise resolves grpcio-tools unpinned in an
# isolated build environment, so newer grpcio-tools releases can generate
# gRPC stubs that are incompatible with the pinned runtime grpcio,
# breaking mypy/import at build time.
"grpcio-tools==1.82.1",
Comment on lines +50 to +62

@coderabbitai coderabbitai Bot Jul 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

python - <<'PY'
import json
import urllib.request

url = "https://pypi.org/pypi/grpcio-tools/1.82.1/json"
with urllib.request.urlopen(url) as response:
    metadata = json.load(response)

for requirement in metadata["info"].get("requires_dist", []):
    if requirement.lower().startswith("protobuf"):
        print(requirement)
PY

rg -n 'grpcio|protobuf|grpcio-tools' providers/openfeature-provider-flagd/pyproject.toml

Repository: open-feature/python-sdk-contrib

Length of output: 2798

🌐 Web query:

PyPI grpcio-tools 1.82.1 requires dist protobuf grpcio

💡 Result:

The Python package grpcio-tools version 1.82.1, released on July 8, 2026, has specific dependency requirements enforced via PyPI [1][2][3]. To install or use this version, the following packages must be met: - protobuf: Version >= 7.35.1 and < 8.0.0 [1]. (Note: This reflects an update in this release, which raised the lower bound from 6.33.5 [2][3].) - grpcio: Version >= 1.82.1 [1]. - setuptools: Version >= 77.0.1 [1]. These constraints ensure compatibility with the gRPC Core 1.82.1 release [2][3]. If you are encountering dependency resolution errors, ensure that your environment's package manager is satisfying these specific version ranges [1].

Citations:

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

printf '--- pyproject dependency snippets ---\n'
rg -n -C 3 '"grpcio|protobuf|grpcio-tools|hatch-protobuf|mypy-protobuf' providers/openfeature-provider-flagd/pyproject.toml || true

printf '\n--- check generated proto imports using local package metadata text ---\n'
# Read-only scan; print Python import-like snippets around generated proto code if present.
fd -a '\.py$' providers/openfeature-provider-flagd | sed 's#^\./##' | while read -r file; do
  if rg -q 'protobuf|grpc|protobuf_reflection|google/protobuf' "$file"; then
    printf '\nFILE: %s\n' "$file"
    rg -n -C 2 'from google|import google|protobuf|grpc' "$file" | head -80
  fi
done

Repository: open-feature/python-sdk-contrib

Length of output: 260

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

printf '%s\n' '--- pyproject dependency snippets ---'
rg -n -C 3 '"grpcio|protobuf|grpcio-tools|hatch-protobuf|mypy-protobuf' providers/openfeature-provider-flagd/pyproject.toml || true

printf '%s\n' ''
printf '%s\n' '--- check generated proto imports using local package metadata text ---'
fd -a '\.py$' providers/openfeature-provider-flagd | sed 's#^\./##' | while read -r file; do
  if rg -q 'protobuf|grpc|protobuf_reflection|google/protobuf' "$file"; then
    printf '%s\n' ""
    printf '%s\n' "FILE: $file"
    rg -n -C 2 'from google|import google|protobuf|grpc' "$file" | head -80
  fi
done

Repository: open-feature/python-sdk-contrib

Length of output: 13398

Align the runtime dependency floors with the build toolchain.

grpcio-tools==1.82.1 requires protobuf >=7.35.1,<8.0.0 and grpcio >=1.82.1, but the runtime metadata still allows protobuf >=7.0.0,<8.0.0 and grpcio >=1.81.0. Either raise/pin those runtime floors, or verify generated flagd gRPC modules import and pass tests across every allowed metadata version.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@providers/openfeature-provider-flagd/pyproject.toml` around lines 50 - 62,
Align the runtime dependency constraints with grpcio-tools==1.82.1 by raising
the protobuf floor to >=7.35.1 and the grpcio floor to >=1.82.1 in the
corresponding runtime dependency declarations. Keep the existing upper bounds
and ensure the build-tool and runtime versions remain compatible.

]
proto_paths = [
".",
Expand Down
Loading
Loading