From 64d8038236b55767c051345712a2f9c14f997464 Mon Sep 17 00:00:00 2001 From: Edgar Arakelyan Date: Wed, 30 Sep 2026 09:34:02 -1000 Subject: [PATCH 1/2] security(deps): bump urllib3 to 2.8.0 Clears the three open advisories against the locked urllib3 2.7.0: an ignored HTTPS-proxy TLS configuration, unbounded buffering of a chunk in HTTPResponse.stream()/read_chunked(), and an infinite loop when streaming chunked deflate. The third-party notice entry moves to 2.8.0; its licence text is unchanged. Co-Authored-By: Claude Opus 5.5 (1M context) --- THIRD_PARTY_NOTICES.md | 2 +- uv.lock | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md index 0f14396e..942e2b08 100644 --- a/THIRD_PARTY_NOTICES.md +++ b/THIRD_PARTY_NOTICES.md @@ -764,7 +764,7 @@ The runtime dependencies of `agentenv-framework` and its `explorer` and `gcp` ex - Source: - [License text 2](#license-text-2) -### urllib3 2.7.0 +### urllib3 2.8.0 - License: MIT - Copyright: Copyright (c) 2008-2020 Andrey Petrov and contributors. diff --git a/uv.lock b/uv.lock index 48003d74..27764ae2 100644 --- a/uv.lock +++ b/uv.lock @@ -3103,11 +3103,11 @@ wheels = [ [[package]] name = "urllib3" -version = "2.7.0" +version = "2.8.0" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/53/0c/06f8b233b8fd13b9e5ee11424ef85419ba0d8ba0b3138bf360be2ff56953/urllib3-2.7.0.tar.gz", hash = "sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c", size = 433602, upload-time = "2026-05-07T16:13:18.596Z" } +sdist = { url = "https://files.pythonhosted.org/packages/e3/05/b17359e1cefb4f909b5e40b1b90a496d987258916dbbf88e842c729f510e/urllib3-2.8.0.tar.gz", hash = "sha256:63bf2ead4c879426ebf22ef2a781eeb4aa3b4ae798a0435506f8687fd5bb9b63", size = 458972, upload-time = "2026-09-15T19:29:36.253Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/7f/3e/5db95bcf282c52709639744ca2a8b149baccf648e39c8cc87553df9eae0c/urllib3-2.7.0-py3-none-any.whl", hash = "sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897", size = 131087, upload-time = "2026-05-07T16:13:17.151Z" }, + { url = "https://files.pythonhosted.org/packages/92/9d/c4e665119135114480843e7ab388fa94d8480650450e6f8e26b70d323a4c/urllib3-2.8.0-py3-none-any.whl", hash = "sha256:0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3", size = 135717, upload-time = "2026-09-15T19:29:34.577Z" }, ] [[package]] From 136678b39ed1906154a008dee9a07deae72c5df5 Mon Sep 17 00:00:00 2001 From: Edgar Arakelyan Date: Wed, 30 Sep 2026 09:38:48 -1000 Subject: [PATCH 2/2] security(deps): move the protocol notice's urllib3 entry to 2.8.0 too The protocol package's own THIRD_PARTY_NOTICES.md lists versions from the same uv.lock, and its agent extra pulls in urllib3. Co-Authored-By: Claude Opus 5.5 (1M context) --- packages/agentenv-protocol/THIRD_PARTY_NOTICES.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/agentenv-protocol/THIRD_PARTY_NOTICES.md b/packages/agentenv-protocol/THIRD_PARTY_NOTICES.md index 70d409e1..7bbbd90c 100644 --- a/packages/agentenv-protocol/THIRD_PARTY_NOTICES.md +++ b/packages/agentenv-protocol/THIRD_PARTY_NOTICES.md @@ -233,7 +233,7 @@ The runtime dependencies of `agentenv-protocol` and its `agent` extra, at the ve - Source: - [License text 20](#license-text-20) -### urllib3 2.7.0 +### urllib3 2.8.0 - License: MIT - Copyright: Copyright (c) 2008-2020 Andrey Petrov and contributors.