Skip to content

fix: resolve Snyk dependency findings (urllib3, certifi, setuptools, unused dev deps) - v2.8.1 - #224

Merged
reeshika-h merged 6 commits into
masterfrom
fix/snyk-sca-dependency-cleanup
Nov 2, 2026
Merged

fix: resolve Snyk dependency findings (urllib3, certifi, setuptools, unused dev deps) - v2.8.1#224
reeshika-h merged 6 commits into
masterfrom
fix/snyk-sca-dependency-cleanup

Conversation

@reeshika-h

@reeshika-h reeshika-h commented Oct 26, 2026

Copy link
Copy Markdown
Contributor

Summary

Resolves the open Snyk SCA tickets for this repo (v2.8.1). Only requirements.txt (dev/CI install list) changes; the runtime requirements in setup.py are unchanged.

Version bumps

  • urllib3 ~=2.7.0 → ~=2.8.0 (DX-27845, DX-27846, DX-27851)
  • certifi → >=2026.10.19 (critical improper certificate validation)
  • setuptools → >=84.1.0 (directory traversal)

Removed unused packages (none imported by the SDK) and the findings they caused

  • tox (+ virtualenv, chardet, distlib, filelock, platformdirs, cachetools): DX-27847, DX-27848, DX-27849, DX-27852, DX-23125
  • twython (+ oauthlib): DX-27844, DX-27850
  • utils (LGPL-3.0): DX-23129
  • astroid (LGPL-2.1): DX-23123
  • pytest-html (+ pytest-metadata): DX-23127, DX-23128
  • black (+ pathspec): DX-23126

Not fixed: DX-23124 (certifi MPL-2.0) — certifi is a hard dependency of requests; needs a policy exception, not a code change.

Version bumped to 2.8.1 with a CHANGELOG entry.

Verification

  • Fresh venv: pip install -r requirements.txt resolves; pip check reports no broken requirements.
  • snyk test --file=requirements.txt: 0 vulnerabilities; only the certifi MPL-2.0 licence note remains.
  • Offline smoke test: SDK imports and builds a Stack on urllib3 2.8.0.
  • Not run: the pytest suite (requires a local config.py with live credentials).

🤖 Generated with Claude Code

reeshika-h and others added 4 commits August 3, 2026 15:41
@reeshika-h
Merge pull request #221 from contentstack/master
e86be5c 
back merge
@reeshika-h @claude
Merge development into back-merge/DX-20927
e1993cd 
Brings back-merge branch up to date with development so master can be back-merged cleanly (DX-20927).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@reeshika-h
Merge pull request #223 from contentstack/back-merge/DX-20927
3db5b97 
DX-20927 | Back-merge master into development
@reeshika-h @claude
fix: resolve Snyk dependency findings, bump to v2.8.1
21a2576 
Bump urllib3, certifi and setuptools to fixed versions and remove
unused dev packages (twython, tox, utils, astroid, pytest-html, black)
that caused the remaining vulnerability and licence findings.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@reeshika-h
reeshika-h requested a review from a team as a code owner October 26, 2026 07:41
@snyk-io

snyk-io Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
✅ Open Source Security 0 0 0 0 0 issues
✅ Licenses 0 0 0 0 0 issues
✅ Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@github-actions

github-actions Bot commented Oct 26, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 4 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

  • Critical without fixes: 0
  • High without fixes: 0
  • Medium without fixes: 4
  • Low without fixes: 0

✅ BUILD PASSED - All security checks passed

@reeshika-h @claude
Fix: keep husky hooks working without pytest-html
b11c30b 
The dev requirements no longer include pytest-html, but the pre-push and
test-runner hooks ran pytest --html. Pass --html only when pytest-html is
installed so the hooks work either way.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Oct 26, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 4 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

  • Critical without fixes: 0
  • High without fixes: 0
  • Medium without fixes: 4
  • Low without fixes: 0

✅ BUILD PASSED - All security checks passed

cs-raj
cs-raj previously approved these changes Oct 30, 2026
View reviewed changes
@reeshika-h
reeshika-h changed the base branch from development to master November 2, 2026 05:46
@reeshika-h
reeshika-h dismissed cs-raj’s stale review November 2, 2026 05:46

The base branch was changed.

@github-actions

github-actions Bot commented Nov 2, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 4 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

  • Critical without fixes: 0
  • High without fixes: 0
  • Medium without fixes: 4
  • Low without fixes: 0

✅ BUILD PASSED - All security checks passed

@reeshika-h
reeshika-h merged commit 9d0a907 into master Nov 2, 2026
10 checks passed
@reeshika-h
reeshika-h deleted the fix/snyk-sca-dependency-cleanup branch November 2, 2026 09:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cs-raj cs-raj cs-raj approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@reeshika-h @cs-raj