Conversation
pvital
force-pushed
the
fedramp-urllib3-cve-fix
branch
3 times, most recently
from
August 31, 2026 15:03
41ea6a0 to
b43b53f
Compare
…VE-2026-44432) - Raise urllib3 lower bound to 2.7.0 across pyproject.toml and all test requirements files to address CVE-2026-44432 - Set requires-python to >=3.10; remove Python 3.9 classifier and add Python 3.14 classifier - Remove version-gated test requirements targeting Python < 3.9 (aiohttp split, sanic pin, tracerite pin) - Update CircleCI jobs: change jobs dependent on Python 3.9 to 3.12, add python 3.14 job. - Update AWS Lambda compatible-runtimes: remove python3.9, add python3.14 - Remove unused 'import sys' from Lambda test conftest.py Signed-off-by: Paulo Vital <paulo.vital@ibm.com>
Starlette-1.0.0 removed `on_startup` and `on_shutdown` parameters from `Starlette` and `Router`, being replaced by `lifespan`. Signed-off-by: Paulo Vital <paulo.vital@ibm.com> (cherry picked from commit 2d3c4c8)
Signed-off-by: Cagri Yonca <cagri@ibm.com> (cherry picked from commit 3dab401)
pvital
force-pushed
the
fedramp-urllib3-cve-fix
branch
from
September 1, 2026 11:22
b43b53f to
68a6a61
Compare
- `in` fails while `get()` works—the latter normalizes the input before lookup. Signed-off-by: Varsha GS <varsha.gs@ibm.com> (cherry picked from commit 770b298)
- Use the documented `HTTPHeaders` interface instead Signed-off-by: Varsha GS <varsha.gs@ibm.com> (cherry picked from commit 90c4669)
Signed-off-by: Paulo Vital <paulo.vital@ibm.com>
pvital
force-pushed
the
fedramp-urllib3-cve-fix
branch
from
September 1, 2026 12:15
68a6a61 to
3028ebd
Compare
CagriYonca
requested changes
Sep 1, 2026
| @@ -1,13 +1,13 @@ | |||
| # (c) Copyright IBM Corp. 2025 | |||
Contributor
There was a problem hiding this comment.
Shall we add kafka-python support, too, while already releasing a version of fedramp?
| - '9094:9094' | ||
| image: public.ecr.aws/ubuntu/kafka:3.1-22.04_edge | ||
| depends_on: [zookeeper] | ||
| ports: |
Contributor
There was a problem hiding this comment.
There is an extra space here
| - store-coverage-report | ||
|
|
||
| py39gevent_starlette: | ||
| py12gevent_starlette: |
Contributor
There was a problem hiding this comment.
The name should be py312gevent_starlette.
| - py39gevent_starlette | ||
| py-version: ["3.10", "3.11", "3.12", "3.13"] | ||
| - py312cassandra | ||
| # - py12gevent_starlette |
| - py39cassandra | ||
| - py39gevent_starlette | ||
| - py312cassandra | ||
| # - py12gevent_starlette |
Member
Author
|
Closing this PR since the fix was addressed directly on the Autotrace webhook image. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This pull request raises the
urllib3lower bound to 2.7.0 acrosspyproject.tomland all test requirements files to address CVE-2026-44432 and CVE-2026-44431. It also setsrequires-pythonto >=3.10; remove the Python 3.9 classifier and addPython 3.14 classifier. Finally, it bumps the package version to
3.5.0.post2.Files Changed
📄
src/instana/version.pyBumps the package version from
3.5.0.post1to3.5.0.post2.📄
tests/requirements-cassandra.txtUpgrades the
urllib3minimum version requirement from>=1.26.5to>=2.7.0.📄
tests/requirements-gevent-starlette.txtUpgrades the
urllib3minimum version requirement from>=1.26.5to>=2.7.0.📄
tests/requirements-pre314.txtUpgrades the
urllib3minimum version requirement from>=1.26.5to>=2.7.0.📄
tests/requirements.txt<=3.8conditional pin foraiohttp, consolidating it to a singleaiohttp>=3.8.3requirement for all Python versions.<3.9conditional pin forsanic, consolidating it to a singlesanic>=19.9.0requirement for all Python versions.tracerite<=1.1.1dependency that was conditionally applied for Python<3.9.urllib3minimum version requirement from>=1.26.5to>=2.7.0.📄
tests_aws/01_lambda/conftest.pyRemoves an unused
import sysstatement from the AWS Lambda test configuration file.