fix(deps): bump virtualenv and opentelemetry-api for CVEs by olivermeyer · Pull Request #744 · aignostics/python-sdk

olivermeyer · 2026-10-22T14:40:13Z

Why?
The hourly scheduled audit on main fails (run 39792833680). pip-audit reports five CVEs in virtualenv 21.13.0: CVE-2026-113722, CVE-2026-113725, CVE-2026-113726, CVE-2026-113732 and CVE-2026-113776.

How?
The dev-group transitive override for virtualenv now requires >=21.14.9, the lowest version that fixes all five. The lock moves only virtualenv to 21.14.12, with uv 0.13.4 to keep lock revision 5.

opentelemetry-api (CVE-2026-114603)
A later audit run (39916165876) also reports CVE-2026-114603 in opentelemetry-api 1.45.0: TraceState.from_header backtracks quadratically on a malformed tracestate header, so one request can use a lot of CPU. A second commit adds the transitive floor opentelemetry-api>=1.45.1 (it comes in through google-api-core and fastmcp). The lock moves only opentelemetry-api from 1.45.0 to 1.45.1.

🤖 Generated with Claude Code

ox-security · 2026-10-22T14:41:18Z

OX Security reviewed this pull request — nothing to fix.

✔ No issues found

Branch fix/virtualenv-cves → main

View scan in OX Security →

claude · 2026-10-22T14:42:46Z

Claude finished @olivermeyer's task in 3m 45s —— View job

PR Review Complete ✅

Comprehensive security dependency update review for virtualenv CVE fixes.

Summary

Verdict: APPROVED - This PR correctly addresses 5 CVEs in virtualenv by bumping the minimum version constraint from >=20.36.1 to >=21.14.9, with the lock file resolving to version 21.14.12.

Critical Checks ✅

1. Maintenance Mode Compliance ✅

The SDK is in maintenance mode (deprecated, support ends April 30, 2027). Per CLAUDE.md maintenance rules:

✅ Rule 2: "Accept dependency updates that fix vulnerabilities" - This PR qualifies
✅ Not a new feature (rejected in maintenance mode)
✅ Anomaly fix: Addresses failing hourly scheduled audit

2. Conventional Commit Format ✅

fix(deps): bump virtualenv to >=21.14.9 for five CVEs

✅ Type: fix (correct for security patch)
✅ Scope: deps (appropriate for dependency update)
✅ Description: Clear and concise
✅ Extended commit body properly documents all 5 CVEs

3. Changes Review ✅

File: pyproject.toml (line 226)

- "virtualenv>=20.36.1",              # pypa/virtualenv#3013 TOCTOU in app_data/lock dir; bundles filelock>=3.20.1 for CVE-2025-68146; transitive via nox/pre-commit
+ "virtualenv>=21.14.9",              # pypa/virtualenv#3013 TOCTOU, bundles filelock>=3.20.1 for CVE-2025-68146 (>=20.36.1); CVE-2026-113722, CVE-2026-113725, CVE-2026-113726, CVE-2026-113732, CVE-2026-113776 (>=21.14.9); transitive via nox/pre-commit

✅ Correct: Version constraint bumped to fix all 5 CVEs
✅ Well-documented: All CVEs listed in inline comment
✅ Transitive context: Notes dependency via nox/pre-commit

File: uv.lock

- version = "21.13.0"
+ version = "21.14.12"

✅ Lock resolution correct: Resolves to 21.14.12 (≥21.14.9 requirement)
✅ Additional dependency: packaging now included (required by newer virtualenv)
✅ Hash verification: Includes sdist and wheel hashes for integrity

4. Test Coverage ✅

✅ No test files modified (correct - this is a dev-dependency change)
✅ No new tests needed (virtualenv only affects development tooling, not SDK functionality)
✅ Label skip:test:long_running already applied (follows repo convention)

5. Breaking Changes Analysis ✅

✅ No breaking changes: virtualenv is in [dependency-groups] dev only
✅ No API changes: Development tooling dependency doesn't affect SDK public API
✅ No CLI changes: Users not affected
✅ Backward compatible: Minimum version constraint allows newer versions

6. Security Impact ✅

CVEs Fixed:

✅ Addresses root cause: Hourly scheduled audit failure (run 39792833680)
✅ Appropriate fix: Minimum version constraint ensures vulnerability is patched
✅ No new vulnerabilities: OX Security scan passed

7. CI/CD Status ⏳

CI/CD pipeline currently queued/running (6 pending runs)
Expected to pass (changes are minimal and non-breaking)
No workflow file modifications

Repository Standards Compliance ✅

Architecture ✅

✅ No module boundary violations (dev dependency only)
✅ No service layer changes
✅ No presentation layer changes (CLI/GUI)

Code Quality ✅

✅ No code changes to lint
✅ No type hints required (dependency metadata only)
✅ Comment formatting follows repo style

Documentation ✅

✅ CVEs documented inline in pyproject.toml
✅ Commit message provides clear rationale
✅ PR description links to failing audit run

Recommendations

No blocking issues found. Minor suggestions:

Consider documenting in CHANGELOG (optional): While this is a dev-dependency update, documenting CVE fixes in the changelog could be valuable for security-conscious users tracking the project.
Verify audit passes: Once CI completes, confirm the scheduled audit now passes with virtualenv 21.14.12.

Review Checklist

Conventional commit format verified
Maintenance mode rules followed
Changes are minimal and focused
No breaking changes introduced
No test coverage gaps
Security vulnerabilities addressed
Documentation adequate
Architecture compliance maintained
CI/CD impact assessed

Verdict: ✅ claude:review:passed

Recommendation: Approve and merge after CI passes.

codecov · 2026-10-22T15:09:43Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.
see 1 file with indirect coverage changes

The scheduled audit fails on virtualenv 21.13.0. It has CVE-2026-113722, CVE-2026-113725, CVE-2026-113726, CVE-2026-113732 and CVE-2026-113776. Version 21.14.9 fixes all five. The lock resolves to 21.14.12. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Fixes CVE-2026-114603 (GHSA-xcq7-p3pf-p88h): quadratic regex backtracking in TraceState.from_header on malformed tracestate headers. Add a transitive floor opentelemetry-api>=1.45.1; it comes in through google-api-core and fastmcp. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

sonarqubecloud · 2026-10-23T08:08:30Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

olivermeyer added the skip:test:long_running Skip long-running tests (≥5min) label Oct 22, 2026

olivermeyer marked this pull request as ready for review October 22, 2026 14:41

olivermeyer requested a review from a team as a code owner October 22, 2026 14:41

claude Bot added the claude:review:passed Automated Claude PR review found no blocking issues on the current head commit label Oct 22, 2026

aig-hannes previously approved these changes Oct 22, 2026

View reviewed changes

olivermeyer dismissed aig-hannes’s stale review via 4d2814a October 22, 2026 15:17

olivermeyer force-pushed the fix/virtualenv-cves branch from ac7c5ef to 4d2814a Compare October 22, 2026 15:17

olivermeyer removed the skip:test:long_running Skip long-running tests (≥5min) label Oct 23, 2026

olivermeyer closed this Oct 23, 2026

olivermeyer reopened this Oct 23, 2026

olivermeyer changed the title ~~fix(deps): bump virtualenv to >=21.14.9 for five CVEs~~ fix(deps): bump virtualenv and opentelemetry-api for CVEs Oct 23, 2026

olivermeyer enabled auto-merge (rebase) October 23, 2026 08:37

kruegener approved these changes Oct 23, 2026

View reviewed changes

olivermeyer merged commit 3ea64e2 into main Oct 23, 2026
28 checks passed

olivermeyer deleted the fix/virtualenv-cves branch October 23, 2026 08:37

Navigation Menu

Repository navigation

fix(deps): bump virtualenv and opentelemetry-api for CVEs - #744

fix(deps): bump virtualenv and opentelemetry-api for CVEs#744
olivermeyer merged 2 commits into
mainfrom
fix/virtualenv-cves

olivermeyer commented Oct 22, 2026 •

edited

Loading

Uh oh!

ox-security Bot commented Oct 22, 2026 •

edited

Loading

Uh oh!

claude Bot commented Oct 22, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Oct 22, 2026 •

edited

Loading

Uh oh!

sonarqubecloud Bot commented Oct 23, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

olivermeyer commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ox-security Bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

claude Bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review Complete ✅

Summary

Critical Checks ✅

1. Maintenance Mode Compliance ✅

2. Conventional Commit Format ✅

3. Changes Review ✅

4. Test Coverage ✅

5. Breaking Changes Analysis ✅

6. Security Impact ✅

7. CI/CD Status ⏳

Repository Standards Compliance ✅

Architecture ✅

Code Quality ✅

Documentation ✅

Recommendations

Review Checklist

Uh oh!

codecov Bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

sonarqubecloud Bot commented Oct 23, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

olivermeyer commented Oct 22, 2026 •

edited

Loading

ox-security Bot commented Oct 22, 2026 •

edited

Loading

claude Bot commented Oct 22, 2026 •

edited

Loading

codecov Bot commented Oct 22, 2026 •

edited

Loading