[0.9.8-bp] sec alerts aiohttp cryptography - #6838
Conversation
Dependabot flagged two transitive dependencies in uv.lock: aiohttp 3.14.1 -> 3.14.3 (GHSA-cq5v-8q36-5273 / CVE-2026-69244) cryptography 49.0.0 -> 50.0.0 (GHSA-g6cj-pr64-35w5 / CVE-2026-69247) Both reach the lock only through the docs app: reflex-enterprise pulls asgiproxy (-> aiohttp) and joserfc (-> cryptography). Neither is a dependency of the published reflex package, so this is a lockfile-only fix with no impact on installs of reflex itself. aiohttp 3.14.3 published outside the 7 day exclude-newer window and resolves on its own. cryptography 50.0.0 published inside it, so add an exclude-newer exemption alongside the existing starlette one. Since cryptography is transitive there is no version floor to pin, and the exemption keeps future security releases resolvable immediately rather than aging out of the window first. Verified the patched versions against their consumers: joserfc 1.7.1 round-trips a JWT on cryptography 50.0.0, and asgiproxy 0.2.0 imports cleanly on aiohttp 3.14.3. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ULSRWe743saVEBbvBxuL9D
`chore` is not a configured towncrier type in pyproject.toml (the types are breaking, deprecation, feature, bugfix, performance, docs, misc), so `_has_pending_fragments()` in scripts/release.py skipped these files and they would never have reached a CHANGELOG: news/6836.chore.md -> news/6836.misc.md news/+sec-aiohttp-cryptography.chore.md -> news/+sec-aiohttp-cryptography.misc.md Both now render under the Miscellaneous heading, verified with `towncrier build --draft`. Also expand the dependency-bump entry: the aiohttp 3.14.1 -> 3.14.3 jump clears CVE-2026-59881 and CVE-2026-69243 (both fixed in 3.14.2) in addition to the reported CVE-2026-69244, and the entry now notes these are docs-app transitive dependencies rather than shipped ones. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ULSRWe743saVEBbvBxuL9D
Replaces the `+`-prefixed placeholder now that the PR number is known, so the changelog entry links back to the pull request. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ULSRWe743saVEBbvBxuL9D
|
Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits. |
Greptile SummaryThe PR updates locked development and documentation dependencies to versions containing security fixes and exempts transitive
Confidence Score: 5/5The PR appears safe to merge, with the dependency updates matching the documented scope and supported environments. The updated lockfile retains compatible artifacts for supported Python versions, the transitive dependency chains match the release notes, and no concrete installation, runtime, or security regression remains.
|
| Filename | Overview |
|---|---|
| pyproject.toml | Adds a documented cryptography exception to the existing uv package-age policy, following the established security-update pattern. |
| uv.lock | Regenerates lock metadata and artifacts for the three security-related dependency upgrades without an identified compatibility regression. |
| news/6836.misc.md | Accurately records the locked Pillow development dependency update. |
| news/6837.misc.md | Accurately records the aiohttp and cryptography updates and their docs-only transitive dependency scope. |
Reviews (1): Last reviewed commit: "Name the dependency-bump news fragment a..." | Re-trigger Greptile
Merging this PR will not alter performance
Comparing 
Footnotes
|
2 participants
backport for pre-release 0.9.8