[python] bump generated client dependency floors above vulnerable ranges (#24186)

* [python] bump generated client dependency floors above vulnerable ranges

The python client generator's manifest templates declared urllib3/aiohttp/pytest floors that intersect known-vulnerable release ranges. Generated clients are libraries without a lockfile, so the dependency graph records the declared range and vulnerability scanners (Dependabot, pip-audit) flag any range that intersects a vulnerable one — every generated client trips security alerts for its downstream consumers even when the resolved version is safe.

Raise the floors above the currently-published advisory ranges (keeping the urllib3 < 3.0.0 cap):

  urllib3  >= 2.1.0  ->  >= 2.7.0    (GHSA-mf9v-mfxr-j63j / CVE-2026-44432, GHSA-qccp-gfcp-xxvc / CVE-2026-44431)
  aiohttp  >= 3.8.4  ->  >= 3.14.1
  pytest   >= 7.2.1  ->  >= 9.0.3    (GHSA-6w46-j5rx-g56g / CVE-2025-71176, dev-only)

Regenerate the affected python samples.

Signed-off-by: Johannes Würbach <johannes.wuerbach@googlemail.com>

* [python] keep bumped dependency floors installable on Python 3.9

The floors in the previous commit (urllib3 >= 2.7.0, aiohttp >= 3.14.1, pytest >= 9.0.3) are only published for Python >= 3.10, but the generated clients declare requires-python = ">=3.9". Python 3.9 consumers would fail to resolve these dependencies (the exact conflict raised in review).

Lower the floors to the highest releases still published for Python 3.9, keeping them well above the original ranges:

  urllib3  >= 2.7.0  ->  >= 2.6.3    (last 2.6.x; 2.7.0 first requires Python >= 3.10)
  aiohttp  >= 3.14.1 ->  >= 3.13.5   (last 3.13.x; 3.14.0 first requires Python >= 3.10)
  pytest   >= 9.0.3  ->  >= 8.4.2    (last 8.x; 9.0.0 first requires Python >= 3.10; dev-only)

These floors clear the older/high-severity advisories the original ranges intersected while staying installable under the declared requires-python. The most recent fixes (urllib3 GHSA-mf9v-mfxr-j63j / GHSA-qccp-gfcp-xxvc, the aiohttp <= 3.14.0 batch, pytest GHSA-6w46-j5rx-g56g) ship only in releases that require Python >= 3.10, so fully clearing them at the declaration level would require raising requires-python to >= 3.10 (a breaking change left to maintainers). Consumers on Python >= 3.10 still resolve to those patched releases naturally, since the floors are open-ended upward.

Regenerate the affected python samples.

Signed-off-by: Johannes Würbach <johannes.wuerbach@googlemail.com>

---------

Signed-off-by: Johannes Würbach <johannes.wuerbach@googlemail.com>

Author: johanneswuerbach

modules/openapi-generator/src/main/resources/python/pyproject.mustache

@@ -34,11 +34,11 @@ include = ["{{packageName}}/py.typed"]
 [tool.poetry.dependencies]
 python = "^3.10"
 {{^async}}
-urllib3 = ">= 2.1.0, < 3.0.0"
+urllib3 = ">= 2.6.3, < 3.0.0"
 {{/async}}
 python-dateutil = ">= 2.8.2"
 {{#asyncio}}
-aiohttp = ">= 3.8.4"
+aiohttp = ">= 3.13.5"
 aiohttp-retry = ">= 2.8.3"
 {{/asyncio}}
 {{#httpx}}
@@ -62,14 +62,14 @@ requires-python = ">=3.9"
 
 dependencies = [
 {{^async}}
-  "urllib3 (>=2.1.0,<3.0.0)",
+  "urllib3 (>=2.6.3,<3.0.0)",
 {{/async}}
   "python-dateutil (>=2.8.2)",
 {{#httpx}}
   "httpx (>=0.28.1)",
 {{/httpx}}
 {{#asyncio}}
-  "aiohttp (>=3.8.4)",
+  "aiohttp (>=3.13.5)",
   "aiohttp-retry (>=2.8.3)",
 {{/asyncio}}
 {{#tornado}}
@@ -101,7 +101,7 @@ requires-poetry = ">=2.0"
 {{^poetry1}}
 [tool.poetry.group.dev.dependencies]
 {{/poetry1}}
-pytest = ">= 7.2.1"
+pytest = ">= 8.4.2"
 pytest-cov = ">= 2.8.1"
 tox = ">= 3.9.0"
 flake8 = ">= 4.0.0"

modules/openapi-generator/src/main/resources/python/requirements.mustache

@@ -1,9 +1,9 @@
 {{^async}}
-urllib3 >= 2.1.0, < 3.0.0
+urllib3 >= 2.6.3, < 3.0.0
 {{/async}}
 python_dateutil >= 2.8.2
 {{#asyncio}}
-aiohttp >= 3.8.4
+aiohttp >= 3.13.5
 aiohttp-retry >= 2.8.3
 {{/asyncio}}
 {{#httpx}}

modules/openapi-generator/src/main/resources/python/setup.mustache

@@ -13,11 +13,11 @@ VERSION = "{{packageVersion}}"
 PYTHON_REQUIRES = ">= 3.10"
 REQUIRES = [
 {{^async}}
-    "urllib3 >= 2.1.0, < 3.0.0",
+    "urllib3 >= 2.6.3, < 3.0.0",
 {{/async}}
     "python-dateutil >= 2.8.2",
 {{#asyncio}}
-    "aiohttp >= 3.8.4",
+    "aiohttp >= 3.13.5",
     "aiohttp-retry >= 2.8.3",
 {{/asyncio}}
 {{#httpx}}

modules/openapi-generator/src/main/resources/python/test-requirements.mustache

@@ -1,4 +1,4 @@
-pytest >= 7.2.1
+pytest >= 8.4.2
 pytest-cov >= 2.8.1
 tox >= 3.9.0
 flake8 >= 4.0.0

samples/client/echo_api/python-disallowAdditionalPropertiesIfNotPresent/pyproject.toml

@@ -11,7 +11,7 @@ keywords = ["OpenAPI", "OpenAPI-Generator", "Echo Server API"]
 requires-python = ">=3.9"
 
 dependencies = [
-  "urllib3 (>=2.1.0,<3.0.0)",
+  "urllib3 (>=2.6.3,<3.0.0)",
   "python-dateutil (>=2.8.2)",
   "pydantic (>=2.11)",
   "typing-extensions (>=4.7.1)",
@@ -24,7 +24,7 @@ Repository = "https://github.com/GIT_USER_ID/GIT_REPO_ID"
 requires-poetry = ">=2.0"
 
 [tool.poetry.group.dev.dependencies]
-pytest = ">= 7.2.1"
+pytest = ">= 8.4.2"
 pytest-cov = ">= 2.8.1"
 tox = ">= 3.9.0"
 flake8 = ">= 4.0.0"

samples/client/echo_api/python-disallowAdditionalPropertiesIfNotPresent/requirements.txt

@@ -1,4 +1,4 @@
-urllib3 >= 2.1.0, < 3.0.0
+urllib3 >= 2.6.3, < 3.0.0
 python_dateutil >= 2.8.2
 pydantic >= 2.11
 typing-extensions >= 4.7.1

samples/client/echo_api/python-disallowAdditionalPropertiesIfNotPresent/setup.py

@@ -23,7 +23,7 @@
 VERSION = "1.0.0"
 PYTHON_REQUIRES = ">= 3.10"
 REQUIRES = [
-    "urllib3 >= 2.1.0, < 3.0.0",
+    "urllib3 >= 2.6.3, < 3.0.0",
     "python-dateutil >= 2.8.2",
     "pydantic >= 2.11",
     "typing-extensions >= 4.7.1",

samples/client/echo_api/python-disallowAdditionalPropertiesIfNotPresent/test-requirements.txt

@@ -1,4 +1,4 @@
-pytest >= 7.2.1
+pytest >= 8.4.2
 pytest-cov >= 2.8.1
 tox >= 3.9.0
 flake8 >= 4.0.0

samples/client/echo_api/python/pyproject.toml

@@ -11,7 +11,7 @@ keywords = ["OpenAPI", "OpenAPI-Generator", "Echo Server API"]
 requires-python = ">=3.9"
 
 dependencies = [
-  "urllib3 (>=2.1.0,<3.0.0)",
+  "urllib3 (>=2.6.3,<3.0.0)",
   "python-dateutil (>=2.8.2)",
   "pydantic (>=2.11)",
   "typing-extensions (>=4.7.1)",
@@ -24,7 +24,7 @@ Repository = "https://github.com/GIT_USER_ID/GIT_REPO_ID"
 requires-poetry = ">=2.0"
 
 [tool.poetry.group.dev.dependencies]
-pytest = ">= 7.2.1"
+pytest = ">= 8.4.2"
 pytest-cov = ">= 2.8.1"
 tox = ">= 3.9.0"
 flake8 = ">= 4.0.0"

samples/client/echo_api/python/requirements.txt

@@ -1,4 +1,4 @@
-urllib3 >= 2.1.0, < 3.0.0
+urllib3 >= 2.6.3, < 3.0.0
 python_dateutil >= 2.8.2
 pydantic >= 2.11
 typing-extensions >= 4.7.1