Update urllib3 to 2.6.0 due to CVE-2025-66418 - #4260
Conversation
Signed-off-by: Matt Liberty <mliberty@precisioninno.com>
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the urllib3 dependency version in tools/AutoTuner/requirements.txt from >=1.26.17 to >=2.6.0. However, the specified version 2.6.0 does not exist on PyPI, which will cause pip install to fail. It is recommended to use a valid, existing version such as >=2.3.0 instead.
| protobuf>=5.26.1 | ||
| SQLAlchemy==1.4.17 | ||
| urllib3>=1.26.17 | ||
| urllib3>=2.6.0 |
There was a problem hiding this comment.
The version 2.6.0 for urllib3 does not exist on PyPI (the latest version is 2.3.0). Specifying urllib3>=2.6.0 will cause pip install to fail because the package manager cannot find a matching version. Please use a valid, existing version of urllib3 (such as 2.3.0).
urllib3>=2.3.0
There was a problem hiding this comment.
Weird, there is a version 2.7.0 at https://pypi.org/project/urllib3/#history
|
This pull request has been automatically marked as stale because it has not had recent activity. It will be closed in 21 days if no further activity occurs. Remove the |
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8d34089953
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| protobuf>=5.26.1 | ||
| SQLAlchemy==1.4.17 | ||
| urllib3>=1.26.17 | ||
| urllib3>=2.6.0 |
There was a problem hiding this comment.
When AutoTuner is installed with Python 3.8, which remains explicitly supported by tools/AutoTuner/pyproject.toml and the setup instructions, pip cannot satisfy this requirement because urllib3 2.6.0 requires Python 3.9 or newer. Consequently, installer.sh retries and ultimately fails on a declared-supported runtime; use a patched 1.26.x release for Python 3.8 via an environment marker, or raise the project's documented requires-python version together with this change.
Useful? React with 👍 / 👎.
1 participant
No description provided.