Skip to content

fix: update requests dependency to 2.33.0 for CVE-2026-25645 compliance#511

Merged
nahua-aignx merged 1 commit intomainfrom
fix/2603-vuln
Mar 26, 2026
Merged

fix: update requests dependency to 2.33.0 for CVE-2026-25645 compliance#511
nahua-aignx merged 1 commit intomainfrom
fix/2603-vuln

Conversation

@marmarciniak95
Copy link
Copy Markdown
Contributor

No description provided.

@sonarqubecloud
Copy link
Copy Markdown

Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the project’s requests dependency to a version that satisfies the stated CVE requirement, keeping both the declared dependency constraints and the uv lockfile in sync.

Changes:

  • Bump requests lower bound from 2.32.5 to 2.33.0 in pyproject.toml.
  • Regenerate/update uv.lock to resolve requests==2.33.0 (including updated sdist/wheel URLs and hashes).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File Description
pyproject.toml Raises the minimum allowed requests version to 2.33.0 (documents CVE rationale inline).
uv.lock Locks requests to 2.33.0 and updates associated artifact metadata/hashes accordingly.

@codecov
Copy link
Copy Markdown

codecov bot commented Mar 26, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.
see 10 files with indirect coverage changes

@nahua-aignx nahua-aignx merged commit 8ad550d into main Mar 26, 2026
30 of 31 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants