From 4678a3c465e114b966b2fb487b4f1c4f972a15fe Mon Sep 17 00:00:00 2001 From: jwvanderstam Date: Sat, 14 Nov 2026 09:18:26 +0100 Subject: [PATCH 1/2] =?UTF-8?q?fix(deps):=20dnspython=202.9.2=20=E2=80=94?= =?UTF-8?q?=20CVE-2026-128089?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit pip-audit fails unit-tests on every PR: dnspython 2.9.1, pulled in by email-validator, carries CVE-2026-128089. The lock was recompiled on Linux with `pip-compile --upgrade-package dnspython`, which moved that pin only. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 5 +++++ requirements.txt | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2e3646c9..d9fe229d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -27,6 +27,11 @@ reasoning attached, in [docs/history/LESSONS_LEARNED.md](docs/history/LESSONS_LE plugin's tools, so unloading it afterwards left them registered. And a loader given an empty registry used the global one instead, since an empty registry is falsy. +### Security + +- **`dnspython` 2.9.2** (CVE-2026-128089). It comes in through `email-validator`; the lock + was recompiled for this package only. + ## [3.6.0] — 2026-11-11 The release of the QP-9 review's open findings (QP-10): R-8 to R-12 and item 13 are fixed, diff --git a/requirements.txt b/requirements.txt index a116ab0b..46102d28 100644 --- a/requirements.txt +++ b/requirements.txt @@ -65,7 +65,7 @@ ddgs==9.16.1 # via -r requirements.in deprecated==1.3.1 # via limits -dnspython==2.9.1 +dnspython==2.9.2 # via email-validator email-validator==2.3.0 # via -r requirements.in From 62de159e75919b2be885f817743479cff154ee6b Mon Sep 17 00:00:00 2001 From: jwvanderstam Date: Sat, 14 Nov 2026 09:56:07 +0100 Subject: [PATCH 2/2] =?UTF-8?q?fix(deps):=20opentelemetry-api=201.45.2=20?= =?UTF-8?q?=E2=80=94=20CVE-2026-126360?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The same pip-audit step fails on opentelemetry-api 1.45.1 (via fastapi), so neither bump passes CI alone: this one and #542's must land together. Recompiled with `pip-compile --upgrade-package opentelemetry-api`; pip-audit --strict over the whole runtime lock now finds nothing. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 5 +++-- requirements.txt | 2 +- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index d9fe229d..214181a0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -29,8 +29,9 @@ reasoning attached, in [docs/history/LESSONS_LEARNED.md](docs/history/LESSONS_LE ### Security -- **`dnspython` 2.9.2** (CVE-2026-128089). It comes in through `email-validator`; the lock - was recompiled for this package only. +- **`dnspython` 2.9.2** (CVE-2026-128089) and **`opentelemetry-api` 1.45.2** + (CVE-2026-126360). Both come in transitively, through `email-validator` and `fastapi`; the lock + was recompiled for these two packages only. ## [3.6.0] — 2026-11-11 diff --git a/requirements.txt b/requirements.txt index 46102d28..a142e86e 100644 --- a/requirements.txt +++ b/requirements.txt @@ -169,7 +169,7 @@ onnxruntime==1.31.1 # pymupdf openpyxl==3.1.5 # via -r requirements.in -opentelemetry-api==1.45.1 +opentelemetry-api==1.45.2 # via fastapi packaging==26.3 # via