fix(deps): bump urllib3, aiohttp, cryptography to patch disclosed CVEs (incl. 1 critical) - #4829
Conversation
- urllib3 2.5.0 -> 2.7.0: fixes GHSA-qccp-gfcp-xxvc (CVE-2026-44431, proxied-redirect header leak), GHSA-2xpw-w6gg-jr37 (CVE-2025-66471, streaming decompression-bomb), GHSA-38jv-5279-wg99 (CVE-2026-21441, decompression-bomb bypass via redirects), GHSA-gm62-xv2j-4w53 (CVE-2025-66418, unbounded decompression chain). Transitive dependency of the core requests dependency; no manifest change needed. - aiohttp 3.12.15 -> 3.14.3 (blaxel/cloudflare extras): clears 30 disclosed advisories, all fixed by the current release; within the existing aiohttp>=3.12,<4 declared range. - cryptography 45.0.7 -> 46.0.7 (encrypt extra + dev group): fixes GHSA-p423-j2cm-9vmq (CVE-2026-39892, CVSS 9.8 critical buffer overflow on non-contiguous buffer input to Hash.update()/similar). No 45.x release fixes this; required widening the declared range from <46 to <47. Not bundled: 4 residual cryptography advisories (GHSA-537c-gmf6-5ccf bundled vulnerable OpenSSL, GHSA-g6cj-pr64-35w5 PKCS#7 Bleichenbacher oracle, GHSA-jwv3-5hgf-82ww path-building DoS, GHSA-m2h6-j472-rp4c wildcard-DNS permittedSubtrees escape) need 48.0.1+/50.0.1, a much larger jump across several majors -- left as a follow-up rather than risk in this PR. litellm's open advisories have no fix available within this repo's own uv exclude-newer=7-days supply-chain freshness policy as of today; will resolve on its own once the fixed litellm release ages past that window.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 74d8a7efb5
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| [[package]] | ||
| name = "aiohttp" | ||
| version = "3.12.15" | ||
| version = "3.14.3" |
There was a problem hiding this comment.
When a user upgrades openai-agents[cloudflare] or openai-agents[blaxel] in an environment that already contains a vulnerable aiohttp 3.12.x release, the unchanged aiohttp>=3.12,<4 requirements in pyproject.toml remain satisfied. This lockfile-only bump therefore protects repository development installs but not SDK consumers, even though these extras directly execute aiohttp networking code; raise both published extra constraints to the first remediated version (>=3.14.3).
AGENTS.md reference: AGENTS.md:L145-L148
Useful? React with 👍 / 👎.
sylvesterkaczmarek
left a comment
sylvesterkaczmarek
left a comment
There was a problem hiding this comment.
There’s the same consumer-side gap for urllib3. This only moves urllib3 to 2.7.0 in uv.lock; the published core requirement is still just requests>=2,<3, which can leave an already-installed vulnerable urllib3 2.5.0 in place. If this PR is meant to remediate the listed urllib3 CVEs for SDK users, the published dependency graph needs a safe urllib3 floor too, not only the dev lock.
2 participants
Automated dependency bump addressing several disclosed CVEs, found via dependency scanning and verified against the OSV database at the target versions before opening this PR.
Changes
2.5.0→2.7.0— transitive dependency of the corerequestsdependency. Fixes:GHSA-qccp-gfcp-xxvc(CVE-2026-44431, CVSS 8.2) — sensitive headers forwarded across origins in proxied low-level redirectsGHSA-2xpw-w6gg-jr37(CVE-2025-66471, CVSS 8.9) — streaming API mishandles highly compressed dataGHSA-38jv-5279-wg99(CVE-2026-21441, CVSS 8.9) — decompression-bomb safeguard bypass via redirectsGHSA-gm62-xv2j-4w53(CVE-2025-66418, CVSS 8.9) — unbounded links in the decompression chain3.12.15→3.14.3(blaxel/cloudflareextras) — within the existingaiohttp>=3.12,<4range. Clears 30 disclosed advisories (CVE-2025-692xx / CVE-2026-345xx series), all fixed as of this release.45.0.7→46.0.7(encryptextra + dev dependency group) — fixesGHSA-p423-j2cm-9vmq(CVE-2026-39892, CVSS 9.8 critical): a buffer overflow when a non-contiguous buffer (e.g.buf[::-1]) is passed to APIs likeHash.update()on Python >3.11. No45.xrelease fixes this advisory, so the declared range inpyproject.tomlneeded widening from>=45.0, <46to>=46.0.7, <47.Verified against
https://api.osv.dev/v1/queryat each target version — zero remaining advisories for urllib3 2.7.0 and aiohttp 3.14.3.Not fully remediated by this PR: cryptography 46.0.7 still carries 4 residual advisories that require a much larger jump (46.x → 48.0.1 for
GHSA-537c-gmf6-5ccf, bundled vulnerable OpenSSL; → a later release forGHSA-g6cj-pr64-35w5PKCS#7 Bleichenbacher oracle,GHSA-jwv3-5hgf-82wwduplicate-self-signed-intermediate path-building DoS, andGHSA-m2h6-j472-rp4cwildcard-DNSpermittedSubtreesescape — all clear only at50.0.1, the current latest). Spanning three more majors (47→50) is a larger compatibility surface than seemed appropriate to bundle here; happy to open that as a follow-up if useful. This PR's 46.0.7 landing was chosen specifically because it closes the one critical (9.8) advisory.litellm (
litellmextra) also has open advisories (e.g.GHSA-4xpc-pv4p-pm3w/CVE-2026-49468, CVSS 9.8) fixed in1.99.0, but this project'spyproject.tomlsets[tool.uv] exclude-newer = "7 days"as a deliberate supply-chain freshness policy, and1.99.0was published within that window as of this PR —uv lock --upgrade-package litellmcorrectly refuses to select it. Not bundled here since overriding that policy isn't this PR's call to make; it should resolve on its own once the fix ages past 7 days, or can be pulled forward explicitly viaexclude-newer-package = { litellm = false }if wanted sooner.Detected by osv-scanner, cross-checked against the OSV API. No code changes outside
pyproject.toml/uv.lock.Filed by Aeon.