security: fix 7 high/critical Dependabot alerts#2216
Conversation
|
👋 @MikaKerman |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughRemoved optional Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
MikaKerman
force-pushed
the
fix/dependabot-high-critical-alerts
branch
from
a791f61 to
bd69f67
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
pyproject.toml (1)
39-44: Consider adding upper bounds to new security-floor pins to reduce resolver driftLines 39-44 add important minimum versions for security-sensitive packages, but leaving them open-ended can pull untested future major releases. The project establishes a pattern of using ranges (e.g.,
slack-sdk = ">=3.20.1,<4.0.0",tenacity = ">=8.0,<10.0"). For deterministic installs, cap these at the next major version:Proposed diff
-deepdiff = ">=8.6.2" -lxml = ">=6.1.0" -pyopenssl = ">=26.0.0" -cryptography = ">=46.0.5" -protobuf = ">=5.29.6" -azure-core = ">=1.38.0" +deepdiff = ">=8.6.2,<9.0.0" +lxml = ">=6.1.0,<7.0.0" +pyopenssl = ">=26.0.0,<27.0.0" +cryptography = ">=46.0.5,<47.0.0" +protobuf = ">=5.29.6,<6.0.0" +azure-core = ">=1.38.0,<2.0.0"🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pyproject.toml` around lines 39 - 44, These new security-floor pins (deepdiff, lxml, pyopenssl, cryptography, protobuf, azure-core) should include an upper-bound to avoid pulling future major, potentially breaking releases; update each version spec from e.g. deepdiff = ">=8.6.2" to a range that caps at the next major (e.g. ">=8.6.2,<9.0.0") and do the same for lxml ("<7.0.0"), pyopenssl ("<27.0.0"), cryptography ("<47.0.0"), protobuf ("<6.0.0"), and azure-core ("<2.0.0") so the resolver remains deterministic and consistent with the project's existing pattern.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@pyproject.toml`:
- Around line 39-44: These new security-floor pins (deepdiff, lxml, pyopenssl,
cryptography, protobuf, azure-core) should include an upper-bound to avoid
pulling future major, potentially breaking releases; update each version spec
from e.g. deepdiff = ">=8.6.2" to a range that caps at the next major (e.g.
">=8.6.2,<9.0.0") and do the same for lxml ("<7.0.0"), pyopenssl ("<27.0.0"),
cryptography ("<47.0.0"), protobuf ("<6.0.0"), and azure-core ("<2.0.0") so the
resolver remains deterministic and consistent with the project's existing
pattern.
| pyopenssl = ">=26.0.0" | ||
| cryptography = ">=46.0.5" | ||
| protobuf = ">=5.29.6" | ||
| azure-core = ">=1.38.0" |
There was a problem hiding this comment.
Do we actually need to add all these? Aren't they resolved automatically after removing the libs below?
There was a problem hiding this comment.
Tested it locally, and you're right. Just removing dbt-fabricspark and dbt-vertica is enough. Poetry resolves all six packages to patched versions automatically without explicit pins. Updated the PR to use the cleaner approach. If Dependabot doesn't clear the alerts after merge, we can add pins as a follow-up.
…erts Remove dbt-fabricspark and dbt-vertica optional deps from lockfile resolution — both were already excluded from the "all" extra and their outdated upstream pins (dbt-core==1.8.5, azure-cli pre-release) caused vulnerable transitive dependency versions to be resolved (deepdiff, protobuf, pyopenssl, etc.). Without them, poetry resolves all 7 high/critical Dependabot alerts to patched versions naturally. Users who need these adapters can still install them directly (e.g. pip install dbt-fabricspark dbt-vertica). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
MikaKerman
force-pushed
the
fix/dependabot-high-critical-alerts
branch
from
bd69f67 to
0713e63
Compare
2 participants
Summary
dbt-fabricsparkanddbt-verticafrom optional deps — both were already excluded from theallextra, and their outdated upstream pins (dbt-core==1.8.5, azure-cli pre-release) forced vulnerable transitive dependency versions to be resolveddeepdiff8.6.1 → 8.6.2 (CVE-2025-58367 critical RCE + CVE-2026-33155 high DoS)lxml5.3.1 → 6.1.0 (CVE-2026-41066 XXE)pyopenssl24.3.0 → 26.1.0 (CVE-2026-27459 buffer overflow)cryptography46.0.3 → 47.0.0 (CVE-2026-26007 subgroup attack)protobuf4.25.6 → 6.33.6 (CVE-2026-0994 recursion bypass)azure-core1.36.0 → 1.39.0 (CVE-2026-21226 deserialization)pip install dbt-fabricspark dbt-vertica)Test plan
🤖 Generated with Claude Code
Summary by CodeRabbit