Skip to content

fix: resolve dependabot vulnerabilities (v0.2.2) - #101

Open
piyushgupta-sumo wants to merge 1 commit into
mainfrom
cve-fix
Open

piyushgupta-sumo wants to merge 1 commit into
mainfrom
cve-fix

Conversation

@piyushgupta-sumo

@piyushgupta-sumo piyushgupta-sumo commented Nov 12, 2026 •

Copy link
Copy Markdown
Collaborator

Summary

  • Upgrade vulnerable dependencies to patched versions: urllib3 >=2.8.0, certifi >=2026.10.18, filelock >=4.2.1, virtualenv >=21.14.9, setuptools >=84.1.0, black >=26.10.1
  • Re-lock Pipfile.lock
  • filelock 4.x requires Python 3.11+, so it is restricted with an environment marker in requirements.txt (SDK still supports 3.10)
  • Bump version to 0.2.2 and update CHANGELOG

Test plan

  • test/test_sumologic.py passes with Sumo Logic credentials set
  • Locked versions are at or above the patched version for every open Dependabot alert

Upgrade urllib3, certifi, filelock, virtualenv, setuptools and black to
patched versions; filelock restricted to Python 3.11+ in requirements.txt.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@piyushgupta-sumo
piyushgupta-sumo requested a review from a team as a code owner November 12, 2026 20:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant