Bump urllib3 to patched release in Python container requirements#38467
Bump urllib3 to patched release in Python container requirements#38467arpitjain099 wants to merge 1 commit into
Conversation
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request addresses a security vulnerability by bumping the urllib3 dependency to version 2.7.0 in the Python SDK container environment configurations. This ensures that all container images are built with a patched version of the library, mitigating known security risks identified by Dependabot. Highlights
New Features🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the urllib3 dependency version across various Python container requirement files. However, the reviewer identified that the specified version 2.7.0 (as well as the previous 2.6.3) does not exist on PyPI, which will result in container build failures. Additionally, the update was found to be applied inconsistently, with several relevant requirement files for Python 3.12 and 3.13 missing from the changes.
| tzlocal==5.3.1 | ||
| uritemplate==4.2.0 | ||
| urllib3==2.6.3 | ||
| urllib3==2.7.0 |
There was a problem hiding this comment.
The version "2.7.0" for urllib3 does not appear to exist on PyPI (the current latest stable version is 2.3.0). Pinning to a non-existent version will cause container build failures. Please verify the intended version; if this is meant to address recent security advisories, you likely intended to use 2.2.2, 2.2.3, or 2.3.0. Additionally, the previous version 2.6.3 also appears to be non-existent on PyPI, suggesting a systematic typo in these requirement files that should be corrected across all instances.
| typing_extensions==4.15.0 | ||
| tzdata==2025.3 | ||
| urllib3==2.6.3 | ||
| urllib3==2.7.0 |
There was a problem hiding this comment.
As noted in other files, urllib3==2.7.0 is not a valid version on PyPI. Please correct this to a valid patched version (e.g., 2.3.0) to avoid build failures.
| tzlocal==5.3.1 | ||
| uritemplate==4.2.0 | ||
| urllib3==2.6.3 | ||
| urllib3==2.7.0 |
There was a problem hiding this comment.
This security update is inconsistent across the container requirement files. The following files are missing from this PR: sdks/python/container/py312/base_image_requirements.txt (Standard Python 3.12) and sdks/python/container/ml/py313/gpu_image_requirements.txt (ML Python 3.13 GPU). Please ensure all relevant containers are updated to maintain a consistent security posture.
|
Checks are failing. Will not request review until checks are succeeding. If you'd like to override that behavior, comment |
1 participant
Summary
urllib3versions from2.6.3to2.7.0in Python SDK container requirements for:sdks/python/container/py310,py311,py313,py314sdks/python/container/ml/py310,py311,py312,py313(including GPU image requirements)Why
Dependabot reports high-severity advisories for
urllib3 < 2.7.0across these container requirement manifests. This change keeps the updates narrowly scoped to the patched urllib3 version.Validation
urllib3==2.7.0.