From 78acf70f1f5f8b3f37c052a4bdb6e7e32b896a08 Mon Sep 17 00:00:00 2001 From: etserend Date: Tue, 20 Oct 2026 18:58:58 -0500 Subject: [PATCH 1/3] fix(deps): upgrade anyio to 4.15.1 (VULN-120002) anyio before 4.14.2 can validate internationalized host names after they were converted with IDNA 2003 instead of IDNA 2008 in connect_tcp() and TLSStream.wrap() (CVE-2026-63374). httpx reaches both through its anyio backend. Update the lockfile only: anyio 4.10.0 -> 4.15.1. Poetry also refreshes the updated package's own dependency, typing-extensions 4.14.1 -> 4.16.0. Co-Authored-By: Claude Code --- poetry.lock | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/poetry.lock b/poetry.lock index 68a4dc3a..52cd173f 100644 --- a/poetry.lock +++ b/poetry.lock @@ -200,23 +200,22 @@ files = [ [[package]] name = "anyio" -version = "4.10.0" +version = "4.15.1" description = "High-level concurrency and networking framework on top of asyncio or Trio" optional = false -python-versions = ">=3.9" +python-versions = ">=3.10" groups = ["main", "dev", "test"] files = [ - {file = "anyio-4.10.0-py3-none-any.whl", hash = "sha256:60e474ac86736bbfd6f210f7a61218939c318f43f9972497381f1c5e930ed3d1"}, - {file = "anyio-4.10.0.tar.gz", hash = "sha256:3f3fae35c96039744587aa5b8371e7e8e603c0702999535961dd336026973ba6"}, + {file = "anyio-4.15.1-py3-none-any.whl", hash = "sha256:6152fdbbf9a77fdec97731721bebf7c4c44f7c29b424b0065826173efc7ed101"}, + {file = "anyio-4.15.1.tar.gz", hash = "sha256:9f28306018cbd6d329e64a36d58256edff76dd996fe423bc957326e578b82a94"}, ] [package.dependencies] idna = ">=2.8" -sniffio = ">=1.1" -typing_extensions = {version = ">=4.5", markers = "python_version < \"3.13\""} +typing_extensions = {version = ">=4.16.0", markers = "python_version < \"3.15\""} [package.extras] -trio = ["trio (>=0.26.1)"] +trio = ["trio (>=0.32.0)"] [[package]] name = "appdirs" @@ -5312,6 +5311,7 @@ files = [ {file = "sniffio-1.3.1-py3-none-any.whl", hash = "sha256:2f6da418d1f1e0fddd844478f41680e794e6051915791a034ff65e5f100525a2"}, {file = "sniffio-1.3.1.tar.gz", hash = "sha256:f4324edc670a0f49750a81b895f35c3adb843cca46f0530f79fc1babb23789dc"}, ] +markers = {main = "python_version <= \"3.13\" and (extra == \"crewai\" or extra == \"all\" or extra == \"openai\" or extra == \"langchain\") or extra == \"openai\" or extra == \"all\" or extra == \"langchain\""} [[package]] name = "sse-starlette" @@ -5721,14 +5721,14 @@ urllib3 = ">=2" [[package]] name = "typing-extensions" -version = "4.14.1" +version = "4.16.0" description = "Backported and Experimental Type Hints for Python 3.9+" optional = false python-versions = ">=3.9" groups = ["main", "dev", "test"] files = [ - {file = "typing_extensions-4.14.1-py3-none-any.whl", hash = "sha256:d1e1e3b58374dc93031d6eda2420a48ea44a36c2b4766a4fdeb3710755731d76"}, - {file = "typing_extensions-4.14.1.tar.gz", hash = "sha256:38b39f4aeeab64884ce9f74c94263ef78f3c22467c8724005483154c26648d36"}, + {file = "typing_extensions-4.16.0-py3-none-any.whl", hash = "sha256:481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8"}, + {file = "typing_extensions-4.16.0.tar.gz", hash = "sha256:dc983d19a509c94dba722ee6abd33940f7c05a89e243c47e907eb4db6f1a43e5"}, ] [[package]] From 8ea362a5a60037a08bb00552e8fcab5f09a4baa0 Mon Sep 17 00:00:00 2001 From: etserend Date: Tue, 20 Oct 2026 19:19:16 -0500 Subject: [PATCH 2/3] fix(deps): add anyio security floor to pyproject (VULN-120002) The lockfile bump only fixes this repository's resolved environment. Add a direct floor so installs of the published splunk-ao wheel also require anyio >= 4.14.2 (CVE-2026-63374), matching the existing security-floor entries for cryptography, pyjwt, idna and requests. poetry.lock only changes its content-hash; resolved versions are unchanged. Co-Authored-By: Claude Code --- poetry.lock | 2 +- pyproject.toml | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/poetry.lock b/poetry.lock index 52cd173f..28e5979b 100644 --- a/poetry.lock +++ b/poetry.lock @@ -6706,4 +6706,4 @@ openai = ["cryptography", "mcp", "openai", "openai-agents", "packaging"] [metadata] lock-version = "2.1" python-versions = "^3.11,<3.15" -content-hash = "8219ff5a4bc2c3be82d45473a92cb251482d8b3b5c02ca3a41ef68432f52deb1" +content-hash = "bde05edce0e20c8156f1c277411e196b5108c7dac4976191d4491e48ceff8e8e" diff --git a/pyproject.toml b/pyproject.toml index 68b51b12..a594f98a 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -68,6 +68,10 @@ filelock = ">=3.20.1" idna = ">=3.15,<4" python-dotenv = ">=1.2.2" requests = ">=2.33.0" +# Security floor only (VULN-120002 / CVE-2026-63374): not imported directly under src/; +# pulled in transitively via httpx (required), openai, mcp and starlette. +# Do not remove as "unused". +anyio = ">=4.14.2" # Security floor only (VULN-106433 / CVE-2026-69247): not imported directly under src/; # pulled in transitively via pdfminer-six (crewai/all) and mcp -> pyjwt[crypto] (openai). # Do not remove as "unused". From f932f8b99da213ce8b7e4000546e837e9c8ef71f Mon Sep 17 00:00:00 2001 From: etserend Date: Tue, 20 Oct 2026 21:02:11 -0500 Subject: [PATCH 3/3] fix(deps): update example anyio pins to 4.14.2 (VULN-120002) Bump anyio in the example requirements files to 4.14.2 (4.15.1 would force typing-extensions>=4.16.0, which conflicts with their existing pins) and refresh the langgraph-fsi-agent "before" poetry.lock (anyio 4.15.1, typing-extensions 4.16.0). Co-Authored-By: Claude Code --- .../langgraph-fsi-agent/before/poetry.lock | 23 ++++++++----------- .../startup-simulator-3000/requirements.txt | 2 +- .../openai-responses/requirements.txt | 2 +- .../elastic-chatbot-rag-app/requirements.txt | 2 +- 4 files changed, 13 insertions(+), 16 deletions(-) diff --git a/examples/agent/langgraph-fsi-agent/before/poetry.lock b/examples/agent/langgraph-fsi-agent/before/poetry.lock index 0ec5e364..1e6fc68f 100644 --- a/examples/agent/langgraph-fsi-agent/before/poetry.lock +++ b/examples/agent/langgraph-fsi-agent/before/poetry.lock @@ -237,25 +237,22 @@ vertex = ["google-auth[requests] (>=2,<3)"] [[package]] name = "anyio" -version = "4.9.0" -description = "High level compatibility layer for multiple asynchronous event loop implementations" +version = "4.15.1" +description = "High-level concurrency and networking framework on top of asyncio or Trio" optional = false -python-versions = ">=3.9" +python-versions = ">=3.10" groups = ["main"] files = [ - {file = "anyio-4.9.0-py3-none-any.whl", hash = "sha256:9f76d541cad6e36af7beb62e978876f3b41e3e04f2c1fbf0884604c0a9c4d93c"}, - {file = "anyio-4.9.0.tar.gz", hash = "sha256:673c0c244e15788651a4ff38710fea9675823028a6f08a5eda409e0c9840a028"}, + {file = "anyio-4.15.1-py3-none-any.whl", hash = "sha256:6152fdbbf9a77fdec97731721bebf7c4c44f7c29b424b0065826173efc7ed101"}, + {file = "anyio-4.15.1.tar.gz", hash = "sha256:9f28306018cbd6d329e64a36d58256edff76dd996fe423bc957326e578b82a94"}, ] [package.dependencies] idna = ">=2.8" -sniffio = ">=1.1" -typing_extensions = {version = ">=4.5", markers = "python_version < \"3.13\""} +typing_extensions = {version = ">=4.16.0", markers = "python_version < \"3.15\""} [package.extras] -doc = ["Sphinx (>=8.2,<9.0)", "packaging", "sphinx-autodoc-typehints (>=1.2.0)", "sphinx_rtd_theme"] -test = ["anyio[trio]", "blockbuster (>=1.5.23)", "coverage[toml] (>=7)", "exceptiongroup (>=1.2.0)", "hypothesis (>=4.0)", "psutil (>=5.9)", "pytest (>=7.0)", "trustme", "truststore (>=0.9.1) ; python_version >= \"3.10\"", "uvloop (>=0.21) ; platform_python_implementation == \"CPython\" and platform_system != \"Windows\" and python_version < \"3.14\""] -trio = ["trio (>=0.26.1)"] +trio = ["trio (>=0.32.0)"] [[package]] name = "asyncer" @@ -4536,14 +4533,14 @@ tenacity = ">=8.2.3,<10.0" [[package]] name = "typing-extensions" -version = "4.14.1" +version = "4.16.0" description = "Backported and Experimental Type Hints for Python 3.9+" optional = false python-versions = ">=3.9" groups = ["main"] files = [ - {file = "typing_extensions-4.14.1-py3-none-any.whl", hash = "sha256:d1e1e3b58374dc93031d6eda2420a48ea44a36c2b4766a4fdeb3710755731d76"}, - {file = "typing_extensions-4.14.1.tar.gz", hash = "sha256:38b39f4aeeab64884ce9f74c94263ef78f3c22467c8724005483154c26648d36"}, + {file = "typing_extensions-4.16.0-py3-none-any.whl", hash = "sha256:481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8"}, + {file = "typing_extensions-4.16.0.tar.gz", hash = "sha256:dc983d19a509c94dba722ee6abd33940f7c05a89e243c47e907eb4db6f1a43e5"}, ] [[package]] diff --git a/examples/agent/startup-simulator-3000/requirements.txt b/examples/agent/startup-simulator-3000/requirements.txt index 2187e916..6740647e 100644 --- a/examples/agent/startup-simulator-3000/requirements.txt +++ b/examples/agent/startup-simulator-3000/requirements.txt @@ -1,5 +1,5 @@ annotated-types==0.7.0 -anyio==4.9.0 +anyio==4.14.2 aiohttp==3.14.3 attrs==25.3.0 certifi==2025.4.26 diff --git a/examples/logging-samples/openai-responses/requirements.txt b/examples/logging-samples/openai-responses/requirements.txt index d83e3f8f..cf2569ba 100644 --- a/examples/logging-samples/openai-responses/requirements.txt +++ b/examples/logging-samples/openai-responses/requirements.txt @@ -2,7 +2,7 @@ # uv pip compile pyproject.toml -o requirements.txt annotated-types==0.7.0 # via pydantic -anyio==4.12.1 +anyio==4.14.2 # via # httpx # openai diff --git a/examples/rag/elastic-chatbot-rag-app/requirements.txt b/examples/rag/elastic-chatbot-rag-app/requirements.txt index 07357dda..134fdd4c 100644 --- a/examples/rag/elastic-chatbot-rag-app/requirements.txt +++ b/examples/rag/elastic-chatbot-rag-app/requirements.txt @@ -12,7 +12,7 @@ aiosignal==1.4.0 # via aiohttp annotated-types==0.7.0 # via pydantic -anyio==4.9.0 +anyio==4.14.2 # via # httpx # openai