From 6d46dbb9c6e9d5a272c290a010523ff5f96cbc31 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 11 May 2026 03:46:49 +0000 Subject: [PATCH 1/2] Update pydantic-ai-slim[logfire] requirement from >=1.90.0 to >=1.93.0 Updates the requirements on [pydantic-ai-slim[logfire]](https://github.com/pydantic/pydantic-ai) to permit the latest version. - [Release notes](https://github.com/pydantic/pydantic-ai/releases) - [Changelog](https://github.com/pydantic/pydantic-ai/blob/main/docs/changelog.md) - [Commits](https://github.com/pydantic/pydantic-ai/compare/v1.90.0...v1.93.0) --- updated-dependencies: - dependency-name: pydantic-ai-slim[logfire] dependency-version: 1.93.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- uv.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/uv.lock b/uv.lock index 05592ff..05d1363 100644 --- a/uv.lock +++ b/uv.lock @@ -186,7 +186,7 @@ requires-dist = [ { name = "openai-agents", specifier = ">=0.4.0" }, { name = "pandas", marker = "extra == 'data'", specifier = ">=3.0.2" }, { name = "pydantic", specifier = ">=2.11.7" }, - { name = "pydantic-ai-slim", extras = ["logfire"], marker = "extra == 'observability'", specifier = ">=1.90.0" }, + { name = "pydantic-ai-slim", extras = ["logfire"], marker = "extra == 'observability'", specifier = ">=1.93.0" }, { name = "pydantic-settings", specifier = ">=2.13.1" }, { name = "pymupdf", marker = "extra == 'data'", specifier = ">=1.27.2.2" }, { name = "python-dotenv", marker = "extra == 'data'", specifier = ">=1.2.2" }, @@ -3290,7 +3290,7 @@ name = "pexpect" version = "4.9.0" source = { registry = "https://pypi.org/simple" } dependencies = [ - { name = "ptyprocess" }, + { name = "ptyprocess", marker = "sys_platform != 'emscripten' and sys_platform != 'win32'" }, ] sdist = { url = "https://files.pythonhosted.org/packages/42/92/cc564bf6381ff43ce1f4d06852fc19a2f11d180f23dc32d9588bee2f149d/pexpect-4.9.0.tar.gz", hash = "sha256:ee7d41123f3c9911050ea2c2dac107568dc43b2d3b0c7557a33212c398ead30f", size = 166450, upload-time = "2023-11-25T09:07:26.339Z" } wheels = [ From 3b20d10addc77437613f6925802a0aa208ff8eac Mon Sep 17 00:00:00 2001 From: "aieng-bot[bot]" Date: Tue, 12 May 2026 01:00:25 +0000 Subject: [PATCH 2/2] chore: bump urllib3 to >=2.7.0 to fix CVE-2026-44431, CVE-2026-44432 Co-authored-by: aieng-bot --- pyproject.toml | 1 + uv.lock | 9 +++++---- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index 93ebb10..e2b27a5 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -51,6 +51,7 @@ default-groups = ["dev", "docs"] override-dependencies = [ "authlib>=1.6.11", # Override aieng-platform-onboard's exact pin to fix GHSA-jj8c-mmj3-mmgv "python-multipart>=0.0.27", # Fix CVE-2026-42561 (DoS in multipart header parsing) + "urllib3>=2.7.0", # Fix CVE-2026-44431, CVE-2026-44432 ] [tool.uv.workspace] diff --git a/uv.lock b/uv.lock index 05d1363..0e272eb 100644 --- a/uv.lock +++ b/uv.lock @@ -24,6 +24,7 @@ members = [ overrides = [ { name = "authlib", specifier = ">=1.6.11" }, { name = "python-multipart", specifier = ">=0.0.27" }, + { name = "urllib3", specifier = ">=2.7.0" }, ] [[package]] @@ -186,7 +187,7 @@ requires-dist = [ { name = "openai-agents", specifier = ">=0.4.0" }, { name = "pandas", marker = "extra == 'data'", specifier = ">=3.0.2" }, { name = "pydantic", specifier = ">=2.11.7" }, - { name = "pydantic-ai-slim", extras = ["logfire"], marker = "extra == 'observability'", specifier = ">=1.93.0" }, + { name = "pydantic-ai-slim", extras = ["logfire"], marker = "extra == 'observability'", specifier = ">=1.90.0" }, { name = "pydantic-settings", specifier = ">=2.13.1" }, { name = "pymupdf", marker = "extra == 'data'", specifier = ">=1.27.2.2" }, { name = "python-dotenv", marker = "extra == 'data'", specifier = ">=1.2.2" }, @@ -4979,11 +4980,11 @@ wheels = [ [[package]] name = "urllib3" -version = "2.6.3" +version = "2.7.0" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/c7/24/5f1b3bdffd70275f6661c76461e25f024d5a38a46f04aaca912426a2b1d3/urllib3-2.6.3.tar.gz", hash = "sha256:1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed", size = 435556, upload-time = "2026-01-07T16:24:43.925Z" } +sdist = { url = "https://files.pythonhosted.org/packages/53/0c/06f8b233b8fd13b9e5ee11424ef85419ba0d8ba0b3138bf360be2ff56953/urllib3-2.7.0.tar.gz", hash = "sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c", size = 433602, upload-time = "2026-05-07T16:13:18.596Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/39/08/aaaad47bc4e9dc8c725e68f9d04865dbcb2052843ff09c97b08904852d84/urllib3-2.6.3-py3-none-any.whl", hash = "sha256:bf272323e553dfb2e87d9bfd225ca7b0f467b919d7bbd355436d3fd37cb0acd4", size = 131584, upload-time = "2026-01-07T16:24:42.685Z" }, + { url = "https://files.pythonhosted.org/packages/7f/3e/5db95bcf282c52709639744ca2a8b149baccf648e39c8cc87553df9eae0c/urllib3-2.7.0-py3-none-any.whl", hash = "sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897", size = 131087, upload-time = "2026-05-07T16:13:17.151Z" }, ] [[package]]