From ec12e54be61f22df772c2b442f47c8c2c942d29f Mon Sep 17 00:00:00 2001 From: Kyle Hounslow Date: Mon, 27 Jul 2026 20:13:18 +0000 Subject: [PATCH] fix(agent-eval-canary): constrain idna>=3.15 for CVE-2026-45409 idna is transitive via opensearch-genai-observability-sdk-py. Add a [tool.uv] constraint-dependencies floor and re-lock; idna 3.11 -> 3.18. CVE-2026-45409 (GHSA-65pc-fj4g-8rjx): idna.encode() DoS, fixed in 3.15. Signed-off-by: Kyle Hounslow --- docker-compose/agent-eval-canary/pyproject.toml | 6 ++++++ docker-compose/agent-eval-canary/uv.lock | 9 ++++++--- 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/docker-compose/agent-eval-canary/pyproject.toml b/docker-compose/agent-eval-canary/pyproject.toml index 4781b9f3..c521c072 100644 --- a/docker-compose/agent-eval-canary/pyproject.toml +++ b/docker-compose/agent-eval-canary/pyproject.toml @@ -9,3 +9,9 @@ dependencies = [ "opentelemetry-sdk", "opentelemetry-exporter-otlp-proto-grpc", ] + +[tool.uv] +# CVE-2026-45409 (GHSA-65pc-fj4g-8rjx): idna.encode() DoS, fixed in 3.15. +# idna is transitive (via requests, through the SDK) and not imported here, +# so floor it as a constraint rather than a direct dependency. +constraint-dependencies = ["idna>=3.15"] diff --git a/docker-compose/agent-eval-canary/uv.lock b/docker-compose/agent-eval-canary/uv.lock index 05fcd4d2..30b1bd1b 100644 --- a/docker-compose/agent-eval-canary/uv.lock +++ b/docker-compose/agent-eval-canary/uv.lock @@ -7,6 +7,9 @@ resolution-markers = [ "python_full_version < '3.13'", ] +[manifest] +constraints = [{ name = "idna", specifier = ">=3.15" }] + [[package]] name = "agent-eval-canary" version = "0.1.0" @@ -237,11 +240,11 @@ wheels = [ [[package]] name = "idna" -version = "3.11" +version = "3.18" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/6f/6d/0703ccc57f3a7233505399edb88de3cbd678da106337b9fcde432b65ed60/idna-3.11.tar.gz", hash = "sha256:795dafcc9c04ed0c1fb032c2aa73654d8e8c5023a7df64a53f39190ada629902", size = 194582, upload-time = "2025-10-12T14:55:20.501Z" } +sdist = { url = "https://files.pythonhosted.org/packages/cd/63/9496c57188a2ee585e0f1db071d75089a11e98aa86eb99d9d7618fc1edce/idna-3.18.tar.gz", hash = "sha256:ffb385a7e039654cef1ab9ef32c6fafe283c0c0467bba1d9029738ce4a14a848", size = 196711, upload-time = "2026-06-02T14:34:07.794Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/0e/61/66938bbb5fc52dbdf84594873d5b51fb1f7c7794e9c0f5bd885f30bc507b/idna-3.11-py3-none-any.whl", hash = "sha256:771a87f49d9defaf64091e6e6fe9c18d4833f140bd19464795bc32d966ca37ea", size = 71008, upload-time = "2025-10-12T14:55:18.883Z" }, + { url = "https://files.pythonhosted.org/packages/1e/5e/d4e9f1a599fb8e573b7b87160658329fbf28d19eac2718f51fc3def3aa5a/idna-3.18-py3-none-any.whl", hash = "sha256:7f952cbe720b688055e3f87de14f5c3e5fdaa8bc3928985c4077ca689de849a2", size = 65455, upload-time = "2026-06-02T14:34:06.319Z" }, ] [[package]]