[Snyk] Security upgrade idna from 2.10 to 3.7#7
Conversation
…nts.txt to reduce vulnerabilities The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-IDNA-6597975
|
Important Review skippedIgnore keyword(s) in the title. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds idna>=3.7 to the requirements file to address a security vulnerability. However, a critical dependency conflict was identified, as this version of idna is incompatible with the current requests library version (2.23.0). To resolve this, the requests library should also be upgraded to version 2.26.0 or higher.
| # see https://airflow.apache.org/docs/apache-airflow/stable/installation/installing-from-pypi.html#constraints-files | ||
| apache-airflow[gcp]==1.10.15 # updates beyond 1.10.15 are untested with this code | ||
| apache-airflow-backport-providers-google==2021.3.3 | ||
| idna>=3.7 # not directly required, pinned by Snyk to avoid a vulnerability |
There was a problem hiding this comment.
This change introduces a critical dependency conflict. While intended to fix SNYK-PYTHON-IDNA-6597975, upgrading to idna>=3.7 is incompatible with requests < 2.26.0. The PR description confirms that requests 2.23.0 is present in the environment, which strictly requires idna<3. This conflict will cause the installation to fail. To resolve this while addressing the security vulnerability, requests must also be upgraded to version 2.26.0 or higher, assuming it remains compatible with apache-airflow==1.10.15.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 1 file
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="composer/blog/gcp-tech-blog/unit-test-dags-cloud-build/requirements.txt">
<violation number="1" location="composer/blog/gcp-tech-blog/unit-test-dags-cloud-build/requirements.txt:5">
P1: This `idna>=3.7` pin conflicts with `requests 2.23.0` (a dependency of `apache-airflow==1.10.15`), which strictly requires `idna<3,>=2.5`. The `requests` library only added support for `idna` 3.x in version 2.26.0. This conflict will cause `pip install` to fail with a dependency resolution error. To fix the vulnerability without breaking installation, `requests` must also be upgraded to at least 2.26.0 (and compatibility with airflow 1.10.15 must be verified).</violation>
</file>
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
| # see https://airflow.apache.org/docs/apache-airflow/stable/installation/installing-from-pypi.html#constraints-files | ||
| apache-airflow[gcp]==1.10.15 # updates beyond 1.10.15 are untested with this code | ||
| apache-airflow-backport-providers-google==2021.3.3 | ||
| idna>=3.7 # not directly required, pinned by Snyk to avoid a vulnerability |
There was a problem hiding this comment.
P1: This idna>=3.7 pin conflicts with requests 2.23.0 (a dependency of apache-airflow==1.10.15), which strictly requires idna<3,>=2.5. The requests library only added support for idna 3.x in version 2.26.0. This conflict will cause pip install to fail with a dependency resolution error. To fix the vulnerability without breaking installation, requests must also be upgraded to at least 2.26.0 (and compatibility with airflow 1.10.15 must be verified).
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At composer/blog/gcp-tech-blog/unit-test-dags-cloud-build/requirements.txt, line 5:
<comment>This `idna>=3.7` pin conflicts with `requests 2.23.0` (a dependency of `apache-airflow==1.10.15`), which strictly requires `idna<3,>=2.5`. The `requests` library only added support for `idna` 3.x in version 2.26.0. This conflict will cause `pip install` to fail with a dependency resolution error. To fix the vulnerability without breaking installation, `requests` must also be upgraded to at least 2.26.0 (and compatibility with airflow 1.10.15 must be verified).</comment>
<file context>
@@ -2,3 +2,4 @@
# see https://airflow.apache.org/docs/apache-airflow/stable/installation/installing-from-pypi.html#constraints-files
apache-airflow[gcp]==1.10.15 # updates beyond 1.10.15 are untested with this code
apache-airflow-backport-providers-google==2021.3.3
+idna>=3.7 # not directly required, pinned by Snyk to avoid a vulnerability
</file context>
2 participants
Snyk has created this PR to fix 1 vulnerabilities in the pip dependencies of this project.
Snyk changed the following file(s):
composer/blog/gcp-tech-blog/unit-test-dags-cloud-build/requirements.txtImportant
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Resource Exhaustion
Summary by cubic
Added
idna>=3.7tocomposer/blog/gcp-tech-blog/unit-test-dags-cloud-build/requirements.txtto remediate SNYK-PYTHON-IDNA-6597975 in transitive dependencies.requests2.23.0 (requiresidna<3), upgraderequeststo a version that supportsidna3.x (e.g.,>=2.28) or adjust conflicting pins.Written for commit 8d46eae. Summary will update on new commits. Review in cubic