security: remove dead pip-freeze snapshot carrying 11 unaddressed CVE alerts#214
Merged
Merged
Conversation
gridappsd-field-bus-lib/info/requirements.txt is an orphaned pip-freeze export from 2023, last hand-touched by release automation as a side effect of pyproject.toml version bumps. Nothing in CI, the Dockerfile, docs, or the source tree reads this path; the field bus library's real dependencies live in gridappsd-field-bus-lib/pyproject.toml. The file pinned vulnerable requests, urllib3, idna, and pygments versions that Dependabot flagged across 11 open alerts. Since the file is not installed or consumed anywhere, deleting it clears every alert without touching a dependency that is actually in use. Verified both test suites (pixi run test, pixi run test-field-bus) stay fully green with the file removed.
craigpnnl
added a commit
that referenced
this pull request
Jul 18, 2026
…alerts (#218) ## Summary Removes `gridappsd-field-bus-lib/info/requirements.txt`, a stale pip-freeze export that no CI workflow, Dockerfile, pixi config, or source file references (confirmed via full-repo grep). The file is never installed by any build, test, or deploy step; it was only ever touched by automated version-bump commits. Deleting it closes all 11 open Dependabot alerts. This mirrors PR #214, which already removed this same file from the `develop` branch with the same rationale and confirmed tests still pass (pixi run test: 51 passed, test-field-bus: 10 passed). ## Alerts resolved **urllib3==1.26.20 (was 5 alerts, 4 HIGH + 1 MEDIUM):** - GHSA-qccp-gfcp-xxvc (HIGH): sensitive headers forwarded across origins in proxied redirects - GHSA-38jv-5279-wg99 (HIGH): decompression-bomb safeguards bypassed on redirects - GHSA-2xpw-w6gg-jr37 (HIGH): streaming API improperly handles highly compressed data - GHSA-gm62-xv2j-4w53 (HIGH): unbounded number of links in decompression chain - GHSA-pq67-6m6q-mj2v (MEDIUM): retries not disabled on PoolManager instantiation **requests==2.28.2 (was 4 MEDIUM alerts):** - GHSA-gc5v-m9x4-r6x2: insecure temp file reuse in extract_zipped_paths() - GHSA-9hjg-9r4m-mvj7: .netrc credentials leaked via malicious URLs - GHSA-9wx4-h78v-vm56: Session does not re-verify after verify=False - GHSA-j8r2-6x86-q33q: Proxy-Authorization header leak **idna==3.10 (was 1 MEDIUM alert):** - GHSA-65pc-fj4g-8rjx: CVE-2024-3651 bypass via specially crafted inputs to idna.encode() **Pygments==2.19.2 (was 1 LOW alert):** - GHSA-5239-wwwm-4pmq: ReDoS via inefficient regex for GUID matching Total: 11 alerts resolved (4 HIGH, 6 MEDIUM, 1 LOW). ## Why delete rather than bump The file is a dead pip-freeze export with no consumer. The real field-bus dependency declaration is in `gridappsd-field-bus-lib/pyproject.toml`. A clean venv install from `pyproject.toml` already resolves urllib3 2.7.0, requests 2.34.2, idna 3.18, and Pygments 2.20.0: all safe versions. Bumping pins in a file that is never installed would leave the file in place as a future alert source. ## Verification - Full-repo grep confirms zero references to this file path. - Clean venv install from `gridappsd-field-bus-lib/pyproject.toml` succeeded; `import gridappsd_field_bus` passes. - Resolved versions from `pyproject.toml`: urllib3 2.7.0, requests 2.34.2, idna 3.18, Pygments 2.20.0 (all at or above safe floors). - `git diff --name-only origin/main...HEAD` shows exactly one file changed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Removes gridappsd-field-bus-lib/info/requirements.txt, a stale pip-freeze export that no CI workflow, Dockerfile, pixi config, or source references (confirmed via full-repo grep and git log --follow: only ever touched by automated version-bump commits). It pinned vulnerable versions (requests==2.28.2, urllib3==1.26.20, idna==3.10, pygments==2.19.2) that generated 11 open Dependabot alerts, and also carried orphaned pins (gridappsd-python==2025.3.1, stomp-py==6.0.0) referencing versions years out of date. The real field-bus dependency declaration lives in gridappsd-field-bus-lib/pyproject.toml. Deleting the dead file clears all 11 alerts through the only path that matters (the file was never installed). Tests green after removal: pixi run test 51 passed, test-field-bus 10 passed.