Skip to content

fix(security): bump requests 2.32.5→2.33.1 in examples/python (ENG-13360)#147

Merged
andriy-sudo merged 1 commit intomainfrom
andriy/ENG-13360-fix-requests
Apr 1, 2026
Merged

fix(security): bump requests 2.32.5→2.33.1 in examples/python (ENG-13360)#147
andriy-sudo merged 1 commit intomainfrom
andriy/ENG-13360-fix-requests

Conversation

@andriy-sudo
Copy link
Copy Markdown
Contributor

Vulnerability Fixes

Package Old New Advisory CVSS Status
requests (examples/python) 2.32.5 2.33.1 GHSA-9wx4-h78v-vm56 (CVE-2026-25645) ✅ Fixed

Changes

  • examples/python/pyproject.toml: Added requests = ">=2.33.0" floor pin
  • examples/python/poetry.lock: Surgical update — requests 2.32.5 → 2.33.1

Ticket

Changelog impact summary
Package Old New Classification Key changes
requests 2.32.5 2.33.1 Patch/security Non-deterministic temp file extraction — no API changes

…360)

requests CVE-2026-25645 — add floor pin >=2.33.0 and surgical lock update to 2.33.1

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@coderabbitai
Copy link
Copy Markdown

coderabbitai bot commented Apr 1, 2026

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 540bb5f3-2194-4dad-a1b2-70e5cd6a5467

📥 Commits

Reviewing files that changed from the base of the PR and between dcf8143 and 97f1743.

⛔ Files ignored due to path filters (1)
  • examples/python/poetry.lock is excluded by !**/*.lock
📒 Files selected for processing (1)
  • examples/python/pyproject.toml

📝 Walkthrough

Walkthrough

The examples/python/pyproject.toml file was updated to add the requests package as a runtime dependency with a minimum version constraint of >=2.33.0. This addition expands the project's dependency list to include the HTTP client library alongside existing project dependencies. No public code entities were modified, only the configuration file's dependency declarations were updated.

🚥 Pre-merge checks | ✅ 2
✅ Passed checks (2 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly summarizes the main change: bumping the requests package from 2.32.5 to 2.33.1 for security purposes in examples/python, with the relevant ticket reference.
Description check ✅ Passed The description is directly related to the changeset, providing detailed context about the vulnerability fix, version bump, files modified, and changelog impact.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch andriy/ENG-13360-fix-requests

Comment @coderabbitai help to get the list of available commands and usage tips.

@andriy-sudo andriy-sudo requested a review from KateZhang98 April 1, 2026 12:10
@andriy-sudo
Copy link
Copy Markdown
Contributor Author

@KateZhang98 — SPOC review request. Reviewer assignment API returned empty (team-access-only repo). Please review and approve when ready.

@andriy-sudo andriy-sudo merged commit 5a90110 into main Apr 1, 2026
3 checks passed
@andriy-sudo andriy-sudo deleted the andriy/ENG-13360-fix-requests branch April 1, 2026 16:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants