Skip to content

chore(deps): bump minimum requests to 2.31 (CVE-2018-18074) #5218

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
skl wants to merge 4 commits into from
Closed

chore(deps): bump minimum requests to 2.31 (CVE-2018-18074) #5218

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
934bed3
chore(deps): bump minimum requests to 2.32 (CVE-2018-18074)
skl May 15, 2026
6abdf3f
docs: changelog entry
skl May 15, 2026
0e17e3d
fix: bump requests in tox.ini to 2.32.3
skl May 15, 2026
7b264ea
fix: pin to 2.31 for compat
skl May 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .changelog/5218.fixed
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Bump minimum `requests` to 2.31 in HTTP/Zipkin exporters to mitigate CVE-2018-18074
2 changes: 1 addition & 1 deletion exporter/opentelemetry-exporter-otlp-proto-http/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ dependencies = [
"opentelemetry-proto == 1.42.0.dev",
"opentelemetry-sdk ~= 1.42.0.dev",
"opentelemetry-exporter-otlp-proto-common == 1.42.0.dev",
"requests ~= 2.7",
"requests ~= 2.31",
Copy link
Copy Markdown
Contributor

@xrmx xrmx May 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These are for compatibility of the API and does not dictate what end users will ends with.

Copy link
Copy Markdown
Contributor

@xrmx xrmx May 15, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IOW the requirements / uv.lock / docker images downstream people are using should be kept up to date, we occasionally bump ours but they are just for testing

"typing-extensions >= 4.5.0",
]

Expand Down
2 changes: 1 addition & 1 deletion exporter/opentelemetry-exporter-zipkin-json/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ classifiers = [
dependencies = [
"opentelemetry-api ~= 1.3",
"opentelemetry-sdk ~= 1.11",
"requests ~= 2.7",
"requests ~= 2.31",
]

[project.entry-points.opentelemetry_traces_exporter]
Expand Down
2 changes: 1 addition & 1 deletion exporter/opentelemetry-exporter-zipkin-proto-http/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ dependencies = [
"opentelemetry-exporter-zipkin-json == 1.42.0.dev",
"opentelemetry-sdk ~= 1.11",
"protobuf ~= 3.12",
"requests ~= 2.7",
"requests ~= 2.31",
]

[project.entry-points.opentelemetry_traces_exporter]
Expand Down
4 changes: 3 additions & 1 deletion tox.ini
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -327,7 +327,9 @@ deps =
# Pinning docker for issue: https://github.com/docker/compose/issues/11309
docker<7
docker-compose==1.29.2
requests==2.28.2
# docker-py < 7's UnixHTTPAdapter overrides only get_connection, which
# requests >= 2.32 no longer calls; pin requests below 2.32 here.
requests==2.31.0
Copy link
Copy Markdown
Contributor

@xrmx xrmx May 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To workaround this we've started using the system docker in -contrib, see open-telemetry/opentelemetry-python-contrib@23ac232

; core packages
-e {toxinidir}/opentelemetry-api
-e {toxinidir}/opentelemetry-semantic-conventions
Expand Down
10 changes: 5 additions & 5 deletions uv.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading