Skip to content

chore(deps): bump minimum requests to 2.31 (CVE-2018-18074)#5218

Closed
skl wants to merge 4 commits into
open-telemetry:mainfrom
skl:skl/fix-cve-2018-18074
Closed

chore(deps): bump minimum requests to 2.31 (CVE-2018-18074)#5218
skl wants to merge 4 commits into
open-telemetry:mainfrom
skl:skl/fix-cve-2018-18074

Conversation

@skl
Copy link
Copy Markdown
Member

@skl skl commented May 15, 2026 •
edited
Loading

Description

An image scanner for a downstream build depending on the otel-injector triggered on a CVE-2018-18074 alert. Investigation showed the otel-injector depends on an outdated version of the requests package as a transitive dependency via this repo (opentelemetry-python).

This PR bump the requests dependency floor to ~= 2.31, for consistency with several existing requirements.txt files across this repo for minimum impact and compatibility.

Note that 2.32 was originally tried but found to be incompatible via CI checks on 0e17e3d.

Type of change

Please delete options that are not relevant.

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • This change requires a documentation update

How Has This Been Tested?

I'm not familiar with this repo, I'm open to guidance on test requirements outside of the standard PR checks, if any.

Does This PR Require a Contrib Repo Change?

  • Yes. - Link to PR:
  • No.

Checklist:

  • Followed the style guidelines of this project
  • Changelogs have been updated
  • Unit tests have been added
  • Documentation has been updated

@skl skl requested a review from a team as a code owner May 15, 2026 14:37
@skl skl mentioned this pull request May 15, 2026
Merged
2 tasks
@skl skl changed the title chore(deps): bump minimum requests to 2.32 (CVE-2018-18074) chore(deps): bump minimum requests to 2.31 (CVE-2018-18074) May 15, 2026
xrmx
xrmx requested changes May 15, 2026
View reviewed changes
Comment thread exporter/opentelemetry-exporter-otlp-proto-http/pyproject.toml
"opentelemetry-sdk ~= 1.42.0.dev",
"opentelemetry-exporter-otlp-proto-common == 1.42.0.dev",
"requests ~= 2.7",
"requests ~= 2.31",
Copy link
Copy Markdown
Contributor

@xrmx xrmx May 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These are for compatibility of the API and does not dictate what end users will ends with.

Copy link
Copy Markdown
Contributor

@xrmx xrmx May 15, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IOW the requirements / uv.lock / docker images downstream people are using should be kept up to date, we occasionally bump ours but they are just for testing

Comment thread tox.ini
requests==2.28.2
# docker-py < 7's UnixHTTPAdapter overrides only get_connection, which
# requests >= 2.32 no longer calls; pin requests below 2.32 here.
requests==2.31.0
Copy link
Copy Markdown
Contributor

@xrmx xrmx May 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To workaround this we've started using the system docker in -contrib, see open-telemetry/opentelemetry-python-contrib@23ac232

@github-project-automation github-project-automation Bot moved this to Reviewed PRs that need fixes in Python PR digest May 15, 2026
@herin049
Copy link
Copy Markdown
Contributor

herin049 commented May 15, 2026

I agree with @xrmx here, pyproject.toml dependencies only indicate API compatibility. It is the user's responsibility to select a specific compatible version for the package. If you want to constrain which versions are allowable to be installed, you should use a constraints file: https://pip.pypa.io/en/latest/user_guide/#constraints-files

@skl
Copy link
Copy Markdown
Member Author

skl commented May 15, 2026

Thanks both for the review, I'll close based on the discussion.

@skl skl closed this May 15, 2026
@github-project-automation github-project-automation Bot moved this from Reviewed PRs that need fixes to Done in Python PR digest May 15, 2026
@skl skl deleted the skl/fix-cve-2018-18074 branch May 15, 2026 16:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@xrmx xrmx xrmx requested changes

Assignees

No one assigned

Labels

None yet

Projects

Python PR digest
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@skl @herin049 @xrmx