Skip to content

fix: upgrade Python and vulnerable test dependencies - #962

Open
rasteja wants to merge 11 commits into
mainfrom
feature/ADDON-89515-python-313-security-deps
Open

fix: upgrade Python and vulnerable test dependencies#962
rasteja wants to merge 11 commits into
mainfrom
feature/ADDON-89515-python-313-security-deps

Conversation

@rasteja

@rasteja rasteja commented Aug 10, 2026

Copy link
Copy Markdown
Collaborator

What changed

  • Sets PSA runtime support to Python 3.13 (>=3.13,<3.14).
  • Resolves pytest to 9.1.1 through the >=9.0.3,<10 constraint.
  • Resolves urllib3 to 2.7.0 through the >=2.5.0,<3 constraint.
  • Resolves filelock to 3.32.2 through the >=3.20.3,<4 constraint.
  • Resolves idna to 3.18 through the dependency graph.
  • Resolves requests to 2.34.2 through the >=2.33.0,<3 constraint.

PSA vulnerability tickets remediated

  • VULN-99752 — filelock 3.12.2 → 3.32.2 (required >=3.20.3)
  • VULN-99761 — idna 3.10 → 3.18 (required >=3.15)
  • VULN-99789 — pytest 7.4.4 → 9.1.1 (required >=9.0.3)
  • VULN-99802 — requests 2.31.0 → 2.34.2 (required >=2.33.0)

Related downstream RFCT tickets

  • VULN-53759 — urllib3 >=2.5.0
  • VULN-86496 — pytest >=9.0.3

This PSA PR provides the compatible PSA versions needed by RFCT, but it does not close those RFCT tickets: their FOSSA findings are against taautomation/regression_field_comparison_tool's own poetry.lock, which requires a separate RFCT remediation PR.

Validation

  • PSA Python 3.13 unit suite: 525 passed.
  • poetry check --lock passed.
  • poetry run pip check passed.
  • RFCT main with this local PSA candidate, pytest 9.1.1, urllib3 2.7.0, and CIM models 6.4.0: 15 passed.

Compatibility impact

This intentionally drops Python 3.7–3.12 support because the selected pytest version requires Python 3.10+, and this PR standardizes PSA on Python 3.13.

@rasteja

rasteja commented Aug 13, 2026

Copy link
Copy Markdown
Collaborator Author

@codex Please review the additional dependency-vulnerability remediation in 95e5d72.\n\nResolved lock selections: filelock 3.12.2 -> 3.32.2 (VULN-99752), idna 3.10 -> 3.18 (VULN-99761), pytest remains 9.1.1 (VULN-99789), and requests 2.31.0 -> 2.34.2 (VULN-99802).\n\nValidation: poetry check --lock; poetry run pip check; poetry run pytest -v tests/unit (525 passed, Python 3.13).

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 95e5d72ce8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread pyproject.toml Outdated
Comment on lines +28 to +29
"Programming Language :: Python :: 3.7",
"Programming Language :: Python :: 3.13",

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Remove the obsolete Python 3.7 support claim

The package now requires Python 3.13, but its published classifiers still claim Python 3.7 support, and the user-facing prerequisites in docs/index.md:15, docs/how_to_use.md:59, and docs/troubleshoot.md:24 continue directing users to Python 3.7. Anyone following those instructions will have installation rejected by the new Requires-Python constraint, so the stale classifier and documentation should be updated with this compatibility change.

Useful? React with 👍 / 👎.

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Addressed in 8e0ef43: removed the Python 3.7 classifier and updated the support and installation troubleshooting docs to Python 3.13. The docs/how_to_use.md 3.7 reference is Docker Compose file-format version 3.7, not a Python support claim, so it remains unchanged. Validation: poetry check --lock and 525 unit tests passed.

@rasteja
rasteja marked this pull request as ready for review August 13, 2026 06:52
@rasteja
rasteja requested a review from a team as a code owner August 13, 2026 06:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant