Skip to content

Upgrade requests and aiohttp to fix SSL handling and header parsing issues#87

Closed
RinZ27 wants to merge 1 commit intoxai-org:mainfrom
RinZ27:fix/upgrade-critical-deps
Closed

Upgrade requests and aiohttp to fix SSL handling and header parsing issues#87
RinZ27 wants to merge 1 commit intoxai-org:mainfrom
RinZ27:fix/upgrade-critical-deps

Conversation

@RinZ27
Copy link

@RinZ27 RinZ27 commented Jan 21, 2026

Bumped requests and aiohttp to their latest stable versions.

Previous constraints were pulling in urllib3 < 2.3.0 and aiohttp < 3.10, which have known quirks with SSL/TLS connection handling and header parsing. After reviewing the logic, I decided that ensuring the SDK remains robust when dealing with API calls and image downloads should be a priority.

Also regenerated uv.lock to reflect these dependency updates.

@RinZ27 RinZ27 requested a review from a team as a code owner January 21, 2026 13:55
@RinZ27 RinZ27 changed the title security: upgrade core dependencies to fix critical CVE-2026-21441 (MitM) & CVE-2025-69223 (DoS) Upgrade requests and aiohttp to fix SSL handling and header parsing issues Jan 21, 2026
@RinZ27 RinZ27 force-pushed the fix/upgrade-critical-deps branch 7 times, most recently from eb0c1a3 to 9c7dec9 Compare January 22, 2026 15:04
@Omar-V2
Copy link
Collaborator

Omar-V2 commented Jan 28, 2026

I'm not sure why this is needed, the current dependency constraints for both urllib3 and aiohttponly set the lower bound to the versions you mentioned. The default behaviour of uv is to try to install the latest compatible version of each package. This change makes the deps more restrictive without any clear upside.

@RinZ27 RinZ27 force-pushed the fix/upgrade-critical-deps branch from a9d2a02 to 02d3c72 Compare January 28, 2026 16:57
@RinZ27
Copy link
Author

RinZ27 commented Jan 28, 2026

Raising the lower bounds ensures that critical fixes for SSL handling and header parsing are strictly enforced across all environments. Even though uv defaults to the latest compatible version, explicit constraints prevent older, problematic versions from being pulled in due to conflicting requirements from other packages.

I've also refreshed the uv.lock to pick up the latest stable releases. @Omar-V2

@RinZ27 RinZ27 force-pushed the fix/upgrade-critical-deps branch from 02d3c72 to a80ac47 Compare January 28, 2026 16:59
@Omar-V2 Omar-V2 closed this Jan 30, 2026
@RinZ27 RinZ27 deleted the fix/upgrade-critical-deps branch January 31, 2026 03:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants