GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — fix: update security dependencies for Python 3.10+ by dependabot[bot] · Pull Request #112 · SocketDev/socket-sdk-python

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 7, 2026 •
edited by jdalton
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

Updates vulnerable dependencies and pins the build action to patched Hatch and virtualenv releases. The lock selects patched AnyIO, cryptography, filelock, pytest, Requests, urllib3 and virtualenv versions.

Compatibility change: requires Python 3.10 or later. Patched dependencies no longer support Python 3.9. Package metadata and README now state the same minimum. Please review this support change before merge.

Validation
  • GitHub: 14 successful checks; two skipped.
  • Local unit suites: 150 passed and one skipped on each of Python 3.10 and 3.12, plus 82 subtests per run.
  • Wheel and install checks remain in progress.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@dependabot
chore(deps): bump virtualenv from 20.36.1 to 21.7.13
c7bb30c 
Bumps [virtualenv](https://github.com/pypa/virtualenv) from 20.36.1 to 21.7.13.
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](pypa/virtualenv@20.36.1...21.7.13)

---
updated-dependencies:
- dependency-name: virtualenv
  dependency-version: 21.7.13
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 7, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner October 7, 2026 10:59
@jdalton
fix: update SDK security dependencies
05676fe 
Require Python 3.10 so the universal lock uses patched releases for every supported interpreter.

Update the setup action to install the patched Hatch and virtualenv toolchain, and document the support boundary.

Assisted-by: Codex:GPT-6
@socket-security

socket-security Bot commented Oct 13, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedpypi/​pytest@​9.0.2 ⏵ 9.0.387 +1100 +2100100100
Updatedpypi/​hatch@​1.16.2 ⏵ 1.18.194100100100100
Updatedpypi/​requests@​2.32.5 ⏵ 2.33.099 +1100 +2100100100

View full report
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@socket-security-staging

socket-security-staging Bot commented Oct 13, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedpytest@​9.0.2 ⏵ 9.0.387 +1100 +2100100100
Updatedhatch@​1.16.2 ⏵ 1.18.195100100100100
Updatedrequests@​2.32.5 ⏵ 2.33.099100 +2100100100

View full report
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@jdalton John-David Dalton (jdalton) changed the title chore(deps): bump virtualenv from 20.36.1 to 21.7.13 • None of this credential batch yet. Changes remain uncommitted in the dedicated worktree. Oct 13, 2026
@jdalton John-David Dalton (jdalton) changed the title • None of this credential batch yet. Changes remain uncommitted in the dedicated worktree. fix: update security dependencies for Python 3.10+ Oct 13, 2026
@jdalton
fix: cap artifact metadata at 2.4
6e5a516 
Keep built distributions readable by the locked Twine metadata parser.

Assisted-by: Codex:GPT-6
lelia
lelia approved these changes Oct 21, 2026
View reviewed changes
@lelia
lelia merged commit 11ca091 into main Oct 21, 2026
15 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@lelia
lelia deleted the dependabot/uv/virtualenv-21.7.13 branch October 21, 2026 20:39
@lelia lelia mentioned this pull request Oct 21, 2026
Release v3.6.1: patched certifi, uv and virtualenv; require certifi>=2026.10.19 #120
Merged
lelia added a commit that referenced this pull request Oct 21, 2026
@lelia
Release v3.6.1: patched certifi, uv and virtualenv; require `…
234bc15 
…certifi>=2026.10.19` (#120)

* chore(release): 3.6.1 with patched certifi, uv and virtualenv

Cut a release that ships the Dependabot security bumps merged since 3.6.0
(#112, #116, #117, #118, #119).

The release build toolchain in setup-hatch still pinned virtualenv 21.7.13
and hatchling 1.32.0, because Dependabot updates uv.lock but not the pip
pins inside the composite action. Sync them to the locked virtualenv
21.14.7 and the [build-system] hatchling 1.32.4 so published artifacts are
built with the patched versions.

* Require certifi>=2026.10.19

requests takes its CA bundle from certifi, and socketdev didn't constrain
it, so pip could leave consumers on a bundle that trusts the compromised
eMudhra intermediate CAs. A floor rather than an exact pin, so later
trust-store fixes still reach them.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lelia lelia lelia approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

@lelia @jdalton
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.