From 62740dd6bfb4a7a1321b739652d57008c7ac6d0f Mon Sep 17 00:00:00 2001 From: Tanvir Farhad Date: Wed, 16 Sep 2026 02:38:12 +0100 Subject: [PATCH 1/3] fix(deps): bump pip to 26.2.1 (Dependabot alert #21) pip < 26.2.0 would incorrectly handle doubly-encoded package URLs from indexes, allowing a malicious index to serve unexpected packages. This updates requirements-lock.txt to pin pip==26.2.1 with the correct hash. Fixes: https://github.com/OWASP/openshield/security/dependabot/21 Signed-off-by: Tanvir Farhad --- requirements-lock.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/requirements-lock.txt b/requirements-lock.txt index 7a88aee..829ddc8 100644 --- a/requirements-lock.txt +++ b/requirements-lock.txt @@ -14,7 +14,7 @@ wheel==0.46.3 \ --hash=sha256:4b399d56c9d9338230118d705d9737a2a468ccca63d5e813e2a4fc7815d8bc4d # The following packages are considered to be unsafe in a requirements file: -pip==26.1.2 \ - --hash=sha256:382ff9f685ee3bc25864f820aa50505825f10f5458ffff07e30a6d96e5715cab +pip==26.2.1 \ + --hash=sha256:71138adf1f4ca900cdb7d289c21b7494329f2332b6d85f0e1c42108c0384ed3e setuptools==83.0.0 \ --hash=sha256:29b23c360f22f414dc7336bb39178cc7bcbf6021ed2733cde173f09dba19abb3 From 9ca38519f2b0eeaf65bea2096d1754ee0c6568e0 Mon Sep 17 00:00:00 2001 From: Tanvir Farhad Date: Sat, 19 Sep 2026 12:43:22 +0100 Subject: [PATCH 2/3] fix(deps): update lock_dependencies.py pip version guard to 26.2.1 Signed-off-by: Tanvir Farhad --- scripts/lock_dependencies.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/lock_dependencies.py b/scripts/lock_dependencies.py index 75bb5d9..7513669 100644 --- a/scripts/lock_dependencies.py +++ b/scripts/lock_dependencies.py @@ -58,7 +58,7 @@ def main() -> int: args = parser.parse_args() if sys.version_info[:2] != (3, 11) or sys.platform != "linux": parser.error("Generate/check locks using Python 3.11 on Linux (the supported runtime).") - if version("pip-tools") != "7.5.3" or version("pip") != "26.1.2": + if version("pip-tools") != "7.5.3" or version("pip") != "26.2.1": parser.error("Install requirements-lock.txt in an isolated virtual environment first.") if args.check: stale = check_locks(ROOT) From 55011dfaf8cda958b0a793a002db3b0cfe0e42fe Mon Sep 17 00:00:00 2001 From: Tanvir Farhad Date: Sat, 19 Sep 2026 13:17:53 +0100 Subject: [PATCH 3/3] fix(deps): upgrade pip-tools to 7.6.1 for pip 26.2.1 compatibility pip-tools 7.5.3 imports stdlib_pkgs from pip._internal.utils.compat, which was removed in pip 26.2.1. pip-tools 7.6.1 dropped that internal dependency (fixed in 7.4.1). Update the source pin in requirements-lock.in, the compiled hash in requirements-lock.txt, and the version guard in lock_dependencies.py to keep all three in sync. Signed-off-by: Tanvir Farhad --- requirements-lock.in | 4 ++-- requirements-lock.txt | 4 ++-- scripts/lock_dependencies.py | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/requirements-lock.in b/requirements-lock.in index f56f8aa..048d142 100644 --- a/requirements-lock.in +++ b/requirements-lock.in @@ -1,5 +1,5 @@ # Isolated tooling used to regenerate/check locks; not application dependencies. -pip==26.1.2 -pip-tools==7.5.3 +pip==26.2.1 +pip-tools==7.6.1 setuptools==83.0.0 wheel==0.46.3 diff --git a/requirements-lock.txt b/requirements-lock.txt index 829ddc8..c67d4a0 100644 --- a/requirements-lock.txt +++ b/requirements-lock.txt @@ -6,8 +6,8 @@ click==8.5.0 \ --hash=sha256:255bc9599cf7748b4b1a446ccc735421bd08a2ae529a8b88597d3de5664ee360 packaging==26.3 \ --hash=sha256:d7193f7c8e4e93f444fde0262bf90af30e16fa0ad0ad44cb553c87339b23cd1c -pip-tools==7.5.3 \ - --hash=sha256:3aac0c473240ae90db7213c033401f345b05197293ccbdd2704e52e7a783785e +pip-tools==7.6.1 \ + --hash=sha256:6111c8b4b07fd14b7223ca921485b0e96cf66e20bf94da95eeed9845f510cb8f pyproject-hooks==1.2.0 \ --hash=sha256:9e5c6bfa8dcc30091c74b0cf803c81fdd29d94f01992a7707bc97babb1141913 wheel==0.46.3 \ diff --git a/scripts/lock_dependencies.py b/scripts/lock_dependencies.py index 7513669..bd855e2 100644 --- a/scripts/lock_dependencies.py +++ b/scripts/lock_dependencies.py @@ -58,7 +58,7 @@ def main() -> int: args = parser.parse_args() if sys.version_info[:2] != (3, 11) or sys.platform != "linux": parser.error("Generate/check locks using Python 3.11 on Linux (the supported runtime).") - if version("pip-tools") != "7.5.3" or version("pip") != "26.2.1": + if version("pip-tools") != "7.6.1" or version("pip") != "26.2.1": parser.error("Install requirements-lock.txt in an isolated virtual environment first.") if args.check: stale = check_locks(ROOT)