Skip to content

Dependency updates#914

Merged
nfelt14 merged 3 commits intomainfrom
nfelt14/dependency-updates
Mar 31, 2026
Merged

Dependency updates#914
nfelt14 merged 3 commits intomainfrom
nfelt14/dependency-updates

Conversation

@nfelt14
Copy link
Copy Markdown
Collaborator

@nfelt14 nfelt14 commented Mar 31, 2026 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
pygments (changelog) ==2.19.2 → ==2.20.0 age confidence
cryptography (changelog) ==46.0.5 → ==46.0.6 age confidence
requests (changelog) ==2.32.5 → ==2.33.0 age confidence

GitHub Vulnerability Alerts

CVE-2026-4539

A security flaw has been discovered in pygments before 2.20.0. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Release Notes

pygments/pygments (pygments)

v2.20.0

Compare Source

(released March 29th, 2026)

GitHub Vulnerability Alerts

CVE-2026-34073

Summary

In versions of cryptography prior to 46.0.5, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for bar.example.com.

This behavior resulted from a gap between RFC 5280 (which defines Name Constraint semantics) and RFC 9525 (which defines service identity semantics): put together, neither states definitively whether Name Constraints should be applied to peer names. To close this gap, cryptography now conservatively rejects any validation where the peer name would be rejected by a name constraint if it were a SAN instead.

In practice, exploitation of this bypass requires an uncommon X.509 topology, one that the Web PKI avoids because it exhibits these kinds of problems. Consequently, we consider this a medium-to-low impact severity.

See CVE-2025-61727 for a similar bypass in Go's crypto/x509.

Remediation

Users should upgrade to 46.0.6 or newer.

Attribution

Reporter: @​1seal

Release Notes

pyca/cryptography (cryptography)

v46.0.6

Compare Source

GitHub Vulnerability Alerts

CVE-2026-25645

Impact

The requests.utils.extract_zipped_paths() utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one.

Affected usages

Standard usage of the Requests library is not affected by this vulnerability. Only applications that call extract_zipped_paths() directly are impacted.

Remediation

Upgrade to at least Requests 2.33.0, where the library now extracts files to a non-deterministic location.

If developers are unable to upgrade, they can set TMPDIR in their environment to a directory with restricted write access.

Release Notes

psf/requests (requests)

v2.33.0

Compare Source

Announcements

  • 📣 Requests is adding inline types. If you have a typed code base that
    uses Requests, please take a look at #​7271. Give it a try, and report
    any gaps or feedback you may have in the issue. 📣

Security

  • CVE-2026-25645 requests.utils.extract_zipped_paths now extracts
    contents to a non-deterministic location to prevent malicious file
    replacement. This does not affect default usage of Requests, only
    applications calling the utility function directly.

Improvements

  • Migrated to a PEP 517 build system using setuptools. (#​7012)

Bugfixes

  • Fixed an issue where an empty netrc entry could cause
    malformed authentication to be applied to Requests on
    Python 3.11+. (#​7205)

Deprecations

  • Dropped support for Python 3.9 following its end of support. (#​7196)

Documentation

  • Various typo fixes and doc improvements.

@nfelt14 nfelt14 requested a review from a team as a code owner March 31, 2026 15:11
@codecov
Copy link
Copy Markdown

codecov Bot commented Mar 31, 2026 •
edited
Loading

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (bf0839c) to head (2ebcc48).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files 
@@            Coverage Diff            @@
##              main      #914   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            4         4           
  Lines          233       233           
  Branches        32        32           
=========================================
  Hits           233       233

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Mar 31, 2026 •
edited
Loading

Test Results (windows)

path passed subtotal
tests\test_bump_version_in_files.py 5 5
tests\test_create_unique_testpypi_version.py 7 7
tests\test_find_unreleased_changelog_items.py 6 6
tests\test_update_development_dependencies.py 13 13
TOTAL 31 31

Link to workflow run

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Mar 31, 2026 •
edited
Loading

Test Results (ubuntu)

path passed subtotal
tests/test_bump_version_in_files.py 5 5
tests/test_create_unique_testpypi_version.py 7 7
tests/test_find_unreleased_changelog_items.py 6 6
tests/test_update_development_dependencies.py 13 13
TOTAL 31 31

Link to workflow run

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Mar 31, 2026 •
edited
Loading

Test Results (macos)

path passed subtotal
tests/test_bump_version_in_files.py 5 5
tests/test_create_unique_testpypi_version.py 7 7
tests/test_find_unreleased_changelog_items.py 6 6
tests/test_update_development_dependencies.py 13 13
TOTAL 31 31

Link to workflow run

@nfelt14 nfelt14 merged commit 1e59bb3 into main Mar 31, 2026
39 checks passed
@nfelt14 nfelt14 deleted the nfelt14/dependency-updates branch March 31, 2026 15:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@nfelt14 nfelt14

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@nfelt14