Repository navigation
fix(deps): urllib3 2.8.0 and next 16.3.8, for advisories published 2026-09-30 - #424
Merged
Merged
Conversation
pip-audit started failing every PR on 2026-09-30 with CVE-2026-97687 and CVE-2026-97689 in urllib3 2.7.0; OSV lists a third, CVE-2026-97688, fixed in the same release: - GHSA-8988-9cw3-xx77: an HTTPS proxy's TLS configuration may be ignored or overridden. - GHSA-gh4c-6fx4-qh6g: chunked deflate streaming can loop forever. - GHSA-vxq7-64xx-v4gw: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory. urllib3 ships in the backend image under requests, so this is an upgrade, not an exception. 2.8.0 is inside requests 2.34.2's range (urllib3<3, >=1.26) and needs Python >=3.10. With it, pip-audit reports 'No known vulnerabilities found' with the existing baseline. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…vcvr-r3jv-pc5j) npm-audit failed #424 on 2026-09-30 with advisory 1240609: remote code execution in next/og ImageResponse, critical, for next >=16.2.0 <16.3.6. We ran 16.3.5. UKIP does not import next/og anywhere, so it is likely not reachable here, but the fix is a patch release. next and eslint-config-next go to 16.3.8, and package.json's floor moves to ^16.3.8 so a fresh resolve cannot land on a vulnerable version. The lockfile keeps all 982 entries, so no platform-specific optional package was dropped. audit:gate: no non-allowlisted high/critical advisories; tsc clean. It rides in this PR because each fix blocks the other's CI: without it the urllib3 PR fails npm-audit, and without urllib3 a next-only PR fails pip-audit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
keilynrp
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two sets of advisories published on 2026-09-30 failed every PR (#423 included). Each fix blocks the other's CI: a urllib3-only PR fails npm-audit, and a next-only PR fails pip-audit. So both ride here.
1. urllib3 2.7.0 → 2.8.0 (backend, ships under
requests)HTTPResponse.stream()/read_chunked()buffers an unbounded chunk-size line2.8.0 is inside the range
requests2.34.2 accepts (<3,>=1.26). pip-audit with the existing baseline:No known vulnerabilities found.2. next 16.3.5 → 16.3.8 (frontend)
GHSA-vcvr-r3jv-pc5j (npm advisory 1240609), critical: remote code execution in
next/ogImageResponse, for>=16.2.0 <16.3.6.next/ognowhere, so it is likely not reachable here, but the fix is a patch release.eslint-config-nextmoves with it, to 16.3.8.package.jsonfloors move to^16.3.8, so a fresh resolve can't land on a vulnerable version.Checks
npm run audit:gate: no non-allowlisted high/critical advisoriestsc --noEmitclean; repo metrics regenerated (nextjs=16.3.8)🤖 Generated with Claude Code