security: pin urllib3 and filelock for CVE fixes #1203
Merged
+3
−0
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Pin minimum versions of transitive dependencies to address: - urllib3>=2.6.0: CVE-2025-66418 (unbounded decompression chain, CVSS 8.9) CVE-2025-66471 (streaming decompression bomb, CVSS 8.9) - filelock>=3.20.1: CVE-2025-68146 (TOCTOU symlink race condition, CVSS 6.3) These are transitive dependencies that may be pulled in at vulnerable versions without explicit pins. The fixes ensure kagent-adk installations get patched versions regardless of resolver order. References: - https://nvd.nist.gov/vuln/detail/CVE-2025-66418 - https://nvd.nist.gov/vuln/detail/CVE-2025-66471 - GHSA-w853-jp5j-5j7f Signed-off-by: Boden Fuller <boden.fuller@gmail.com>
felipefrocha
suggested changes
Jan 14, 2026
| "jsonref>=1.1.0", | ||
| "a2a-sdk>=0.3.22", | ||
| # Security: pin minimum versions for CVE fixes in transitive dependencies | ||
| "urllib3>=2.6.0", # CVE-2025-66418, CVE-2025-66471: unbounded decompression DoS |
Contributor
Author
There was a problem hiding this comment.
Good point - updated to >=2.6.3. Thanks for the review!
Signed-off-by: Boden Fuller <boden.fuller@gmail.com>
Contributor
|
Hey there, you will need to merge with main and then I can merge |
Resolved conflict in pyproject.toml by keeping both: - Security pins for urllib3 and filelock (CVE fixes) - New boto3 dependency from upstream Signed-off-by: Boden Fuller <boden.fuller@gmail.com>
Contributor
Author
|
Branch synced with upstream main. All checks passing:
Ready for merge. |
EItanya
approved these changes
Jan 16, 2026
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Pin minimum versions of transitive dependencies to address high-severity CVEs:
urllib3 vulnerabilities (CVE-2025-66418, CVE-2025-66471)
filelock vulnerability (CVE-2025-68146)
Why explicit pins?
These are transitive dependencies that may be pulled in at vulnerable versions without explicit pins, depending on resolver order and other package constraints. Pinning ensures kagent-adk installations always get patched versions.
Changes
python/packages/kagent-adk/pyproject.toml: Added minimum version pins for urllib3 and filelockTest plan