Skip to content

[CVE Remediation] Upgrade urllib3 to 2.8.0 or greater. #394

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
mjohanse-emr wants to merge 1 commit into from
Closed

[CVE Remediation] Upgrade urllib3 to 2.8.0 or greater. #394

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions packages/ni-grpc-extensions/poetry.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions packages/ni-grpc-extensions/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,7 @@ ni-measurementlink-discovery-v1-proto = { path = "../ni.measurementlink.discover
optional = true

[tool.poetry.group.docs.dependencies]
urllib3 = ">=2.8.0,<3.0"

@bkeryan bkeryan Oct 7, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Adding this dependency to each project is unnecessary. To upgrade indirect dependencies, use Renovate to do "lock file maintenance".

@mjohanse-emr mjohanse-emr Oct 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@bkeryan
I think I may be misunderstanding how CVE remediation is supposed to work for python packages. I know that dependabot uses the .lock file to determine if there is an issue, but other than that, the .lock file doesn't affect what is installed to the client's machine using pip install. Therefore, I thought it would be necessary to update our pyproject.toml to ensure that we are shipping at least 2.8.0, regardless of what is in the lock file.

If we don't update the pyproject.toml, can we rely on pip install to resolve to urllib3>=2.8.0?

@bkeryan bkeryan Oct 8, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the .lock file doesn't affect what is installed to the client's machine using pip install.

Right. The lock file affects what is installed when running CI/PR workflows.

Therefore, I thought it would be necessary to update our pyproject.toml to ensure that we are shipping at least 2.8.0, regardless of what is in the lock file.

We are not "shipping" urllib3.

We are not referencing urllib3 in our distribution package's metadata.

To see the package metadata, unzip the .whl file (e.g. https://files.pythonhosted.org/packages/53/ee/c2f7ce4b004422addd6e02eef69a2606b26966da56098a8d1667a64cba20/ni_grpc_extensions-1.1.0-py3-none-any.whl) with 7-Zip and look at the file in the dist-info directory called METADATA:

Metadata-Version: 2.3
Name: ni-grpc-extensions
Version: 1.1.0
Summary: gRPC Extensions
License: MIT
Keywords: grpc,extensions,channel_pool
Author: NI
Author-email: opensource@ni.com
Maintainer: Joe Friedrichsen
Maintainer-email: joe.friedrichsen@emerson.com
Requires-Python: >=3.10,<4.0
Classifier: Development Status :: 5 - Production/Stable
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: Manufacturing
Classifier: Intended Audience :: Science/Research
Classifier: License :: OSI Approved :: MIT License
Classifier: Operating System :: Microsoft :: Windows
Classifier: Operating System :: POSIX
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Programming Language :: Python :: Implementation :: CPython
Requires-Dist: grpcio (>=1.49.0,<2.0)
Requires-Dist: traceloggingdynamic (>=1.0) ; sys_platform == "win32"
Project-URL: Documentation, https://ni-grpc-extensions.readthedocs.io/en/latest/
Project-URL: Repository, https://github.com/ni/ni-apis-python
Description-Content-Type: text/markdown

These are all of the dependencies:

Requires-Dist: grpcio (>=1.49.0,<2.0)
Requires-Dist: traceloggingdynamic (>=1.0) ; sys_platform == "win32"

If we don't update the pyproject.toml, can we rely on pip install to resolve to urllib3>=2.8.0?

Our distribution packages do not depend on urllib3, do they? The "docs" dependency group indirectly depends on urllib3, but we don't ship the "docs", "test", "lint", etc. dependency groups in the distribution package.

# The latest Sphinx requires a recent Python version.
Sphinx = [
{ version = ">=8.1", python = ">=3.10,<3.11" },
Expand Down
10 changes: 5 additions & 5 deletions packages/ni.datamonikers.v1.client/poetry.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions packages/ni.datamonikers.v1.client/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,7 @@ pytest-mock = ">=3.0"
optional = true

[tool.poetry.group.docs.dependencies]
urllib3 = ">=2.8.0,<3.0"
# The latest Sphinx requires a recent Python version.
Sphinx = [
{ version = ">=8.1", python = ">=3.10,<3.11" },
Expand Down
8 changes: 4 additions & 4 deletions packages/ni.datamonikers.v1.proto/poetry.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions packages/ni.datamonikers.v1.proto/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,7 @@ pytest-mock = ">=3.0"
optional = true

[tool.poetry.group.docs.dependencies]
urllib3 = ">=2.8.0,<3.0"
# The latest Sphinx requires a recent Python version.
Sphinx = [
{ version = ">=8.1", python = ">=3.10,<3.11" },
Expand Down
8 changes: 4 additions & 4 deletions packages/ni.grpcdevice.v1.proto/poetry.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions packages/ni.grpcdevice.v1.proto/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,7 @@ pytest-mock = ">=3.0"
optional = true

[tool.poetry.group.docs.dependencies]
urllib3 = ">=2.8.0,<3.0"
# The latest Sphinx requires a recent Python version.
Sphinx = [
{ version = ">=8.1", python = ">=3.10,<3.11" },
Expand Down
8 changes: 4 additions & 4 deletions packages/ni.measurementlink.discovery.v1.client/poetry.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions packages/ni.measurementlink.discovery.v1.client/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,7 @@ pytest-mock = ">=3.0"
optional = true

[tool.poetry.group.docs.dependencies]
urllib3 = ">=2.8.0,<3.0"
# The latest Sphinx requires a recent Python version.
Sphinx = [
{ version = ">=8.1", python = ">=3.10,<3.11" },
Expand Down
8 changes: 4 additions & 4 deletions packages/ni.measurementlink.discovery.v1.proto/poetry.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions packages/ni.measurementlink.discovery.v1.proto/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,7 @@ hightime = { version = ">=0.3.0.dev0", allow-prereleases = true }
optional = true

[tool.poetry.group.docs.dependencies]
urllib3 = ">=2.8.0,<3.0"
# The latest Sphinx requires a recent Python version.
Sphinx = [
{ version = ">=8.1", python = ">=3.10,<3.11" },
Expand Down
8 changes: 4 additions & 4 deletions packages/ni.measurementlink.measurement.v1.proto/poetry.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions packages/ni.measurementlink.measurement.v1.proto/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,7 @@ hightime = { version = ">=1.0.0" }
optional = true

[tool.poetry.group.docs.dependencies]
urllib3 = ">=2.8.0,<3.0"
# The latest Sphinx requires a recent Python version.
Sphinx = [
{ version = ">=8.1", python = ">=3.10,<3.11" },
Expand Down
8 changes: 4 additions & 4 deletions packages/ni.measurementlink.measurement.v2.proto/poetry.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions packages/ni.measurementlink.measurement.v2.proto/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,7 @@ hightime = { version = ">=1.0.0" }
optional = true

[tool.poetry.group.docs.dependencies]
urllib3 = ">=2.8.0,<3.0"
# The latest Sphinx requires a recent Python version.
Sphinx = [
{ version = ">=8.1", python = ">=3.10,<3.11" },
Expand Down
8 changes: 4 additions & 4 deletions packages/ni.measurementlink.pinmap.v1.client/poetry.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions packages/ni.measurementlink.pinmap.v1.client/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,7 @@ pytest-mock = ">=3.0"
optional = true

[tool.poetry.group.docs.dependencies]
urllib3 = ">=2.8.0,<3.0"
# The latest Sphinx requires a recent Python version.
Sphinx = [
{ version = ">=8.1", python = ">=3.10,<3.11" },
Expand Down
8 changes: 4 additions & 4 deletions packages/ni.measurementlink.pinmap.v1.proto/poetry.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions packages/ni.measurementlink.pinmap.v1.proto/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,7 @@ pytest-mock = ">=3.0"
optional = true

[tool.poetry.group.docs.dependencies]
urllib3 = ">=2.8.0,<3.0"
# The latest Sphinx requires a recent Python version.
Sphinx = [
{ version = ">=8.1", python = ">=3.10,<3.11" },
Expand Down
8 changes: 4 additions & 4 deletions packages/ni.measurementlink.proto/poetry.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions packages/ni.measurementlink.proto/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,7 @@ pytest-mock = ">=3.0"
optional = true

[tool.poetry.group.docs.dependencies]
urllib3 = ">=2.8.0,<3.0"
# The latest Sphinx requires a recent Python version.
Sphinx = [
{ version = ">=8.1", python = ">=3.10,<3.11" },
Expand Down
8 changes: 4 additions & 4 deletions packages/ni.measurementlink.sessionmanagement.v1.client/poetry.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
Loading