From 5ff2dbb2d7916cec94ba98ce83e8c94f384038ba Mon Sep 17 00:00:00 2001 From: QTS-AH Date: Wed, 21 Oct 2026 22:57:20 +0000 Subject: [PATCH] chore(deps): bump anyio 4.13.0 to 4.14.2 (CVE-2026-63374) ## Summary Bumps the transitive `anyio` dependency in `uv.lock` from **4.13.0** to **4.14.2**, the first release carrying the fix for **CVE-2026-63374** (CVSS 9.3): TLSStream's IDNA 2003 host-name encoding left a certificate-spoofing window. `anyio` comes in through `httpx`, so this touches the generated client's transport stack. ## Change `uv lock --upgrade-package anyio==4.14.2` - only the `anyio` entries change (version plus sdist and wheel URL/hash). The unrelated `zipp` marker churn that `uv` also produced was reverted, so the diff is a single package bump. ## Verification (on top of current `main`, pyproject 0.128.37) - `uv sync --frozen --python 3.11` -> `anyio 4.14.2` installed - `uv run ruff check src/ tests/` -> All checks passed - `uv run ruff format --check src/ tests/` -> 283 files already formatted - `uv run mypy src/ tests/` -> Success: no issues found in 283 source files - `uv run pytest -q` -> **58 passed, 1 skipped** (the skip is the pre-existing openapi.yaml-absent smoke check) - `uv lock --check` -> consistent No source changes and no API surface change. Note: the `build wheel + sdist` job fails on the openapi.yaml-vs-pyproject version check. That is pre-existing and unrelated - current `main` (pyproject `0.128.37`) already fails it because upstream `openapi.yaml` is now `0.128.41`. The `lint + mypy + pytest` matrix passes. --- uv.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/uv.lock b/uv.lock index b38c93d..00c178c 100644 --- a/uv.lock +++ b/uv.lock @@ -26,15 +26,15 @@ wheels = [ [[package]] name = "anyio" -version = "4.13.0" +version = "4.14.2" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "idna" }, { name = "typing-extensions", marker = "python_full_version < '3.13'" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/19/14/2c5dd9f512b66549ae92767a9c7b330ae88e1932ca57876909410251fe13/anyio-4.13.0.tar.gz", hash = "sha256:334b70e641fd2221c1505b3890c69882fe4a2df910cba14d97019b90b24439dc", size = 231622, upload-time = "2026-03-24T12:59:09.671Z" } +sdist = { url = "https://files.pythonhosted.org/packages/61/cc/a381afa6efea9f496eff839d4a6a1aed3bfafc7b3ab4b0d1b243a12573dd/anyio-4.14.2.tar.gz", hash = "sha256:cfa139f3ed1a23ee8f88a145ddb5ac7605b8bbfd8592baacd7ce3d8bb4313c7f", size = 260176, upload-time = "2026-07-12T20:29:07.082Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/da/42/e921fccf5015463e32a3cf6ee7f980a6ed0f395ceeaa45060b61d86486c2/anyio-4.13.0-py3-none-any.whl", hash = "sha256:08b310f9e24a9594186fd75b4f73f4a4152069e3853f1ed8bfbf58369f4ad708", size = 114353, upload-time = "2026-03-24T12:59:08.246Z" }, + { url = "https://files.pythonhosted.org/packages/da/35/f2287558c17e29fafc8ef3daf819bb9834061cfa43bff8014f7df7f63bdc/anyio-4.14.2-py3-none-any.whl", hash = "sha256:9f505dda5ac9f0c8309b5e8bd445a8c2bf7246f3ce950121e45ea15bc41d1494", size = 125813, upload-time = "2026-07-12T20:29:05.763Z" }, ] [[package]]