Skip to content

chore: floor urllib3 in the [eth] extra #593

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Zyrtnin merged 1 commit into from
Sep 4, 2026
Merged

chore: floor urllib3 in the [eth] extra #593

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,19 @@ follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [Unreleased]

### Security

- **`pyrxd[eth]` now floors `urllib3>=2.7.0`.** pyrxd does not import urllib3; it arrives two levels
down (`web3` -> `requests` -> `urllib3<3,>=1.26`), so installing the extra pulls it either way.
Versions below 2.7.0 carry PYSEC-2026-141 (a proxied cross-origin redirect forwards sensitive
headers) and PYSEC-2026-142 (a decompression bomb via Brotli streaming or `drain_conn`).

**Hygiene, not a fix — neither is reachable through pyrxd's usage**, measured: brotli is not
installed, `drain_conn` appears in 0 files of web3/requests, and web3 uses `stream=True` at 0
sites. The header leak needs both a configured proxy and a hostile redirect from the RPC endpoint.
The floor exists so a consumer's own `pip-audit` is not handed a finding by our extra, and should
be removed once `requests` floors urllib3 itself.

### Fixed

- **Radiant-chain reserves were converted with the BITCOIN interval at seven sites (#579).**
Expand Down
18 changes: 18 additions & 0 deletions pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,10 +74,28 @@ dependencies = [
# DIRECTLY, so leaving it implicit rests on two levels of transitive luck.
#
# aiohttp is deliberately absent: it is already a runtime dependency, not an eth-only one.
#
# urllib3 is different from the three above and the difference matters: pyrxd does NOT import it.
# It arrives two levels down — `web3` requires `requests>=2.23.0`, which requires
# `urllib3<3,>=1.26` — so installing this extra pulls it whether we mention it or not.
#
# HYGIENE, NOT A FIX. urllib3 < 2.7.0 carries PYSEC-2026-141 (a proxied cross-origin redirect
# forwards sensitive headers) and PYSEC-2026-142 (a decompression bomb via Brotli streaming or
# `drain_conn`). MEASURED as unreachable through pyrxd's usage on 2026-09-03: brotli is not
# installed, `drain_conn` appears in 0 files of web3/requests, and web3 uses `stream=True` at 0
# sites. The header leak needs a proxy configured AND a hostile redirect from the RPC endpoint —
# the vulnerable call does exist (`requests/adapters.py:651` passes `assert_same_host=False`
# through a ProxyManager), so the path is real but the exploit was not demonstrated.
#
# The floor is here so `pip install pyrxd[eth]` does not hand a consumer a package their own
# `pip-audit` will flag. Owning a constraint on a package we do not import has a cost — it can
# conflict with a consumer's tree — so this is the only such floor, and it should be REMOVED once
# `requests` itself floors urllib3 above 2.7.0.
eth = [
"web3>=7.16.0,<8.0.0",
"eth-account>=0.14.0,<1.0.0",
"eth-keys>=0.8.0,<1.0.0",
"urllib3>=2.7.0",
]

[project.urls]
Expand Down
Loading