Skip to content

ci(locks): bump virtualenv for CVE-2026-113722 #152

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
napetrov merged 2 commits into from
Oct 22, 2026
Merged

ci(locks): bump virtualenv for CVE-2026-113722 #152

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
552951b
ci(locks): bump virtualenv to 21.14.12 for CVE-2026-113722
napetrov Oct 21, 2026
bc23be4
test(locks): allow the virtualenv cooldown exemption
napetrov Oct 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions dokimi/requirements-ci.lock.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# This file was autogenerated by uv via the following command:
# uv pip compile requirements-ci.txt --constraint=requirements.lock.txt --universal --python-version=3.11 --exclude-newer=P7D --exclude-newer-package=certifi=false --exclude-newer-package=uv=false --generate-hashes --output-file=requirements-ci.lock.txt
# uv pip compile requirements-ci.txt --constraint=requirements.lock.txt --universal --python-version=3.11 --exclude-newer=P7D --exclude-newer-package=certifi=false --exclude-newer-package=uv=false --exclude-newer-package=virtualenv=false --generate-hashes --output-file=requirements-ci.lock.txt

@exai-bot exai-bot Oct 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor (plausible, maintainability): virtualenv cooldown exemption is permanent and not tied to a removal condition

  • Problem: virtualenv is a transitive dependency (via pre-commit) with no exact pin in requirements-ci.txt. With --exclude-newer-package=virtualenv=false in the header, every later --upgrade refresh can take a virtualenv release younger than 7 days, with no review of that release.
  • Why it matters: the PR text says to drop the exemption later, but nothing enforces it. test_tools_lock_exempts_only_pins_younger_than_the_cooldown now asserts the exemption is present, so removing it means editing the test too.
  • Evidence: dokimi/tests/test_dependency_locks.py:176-183.

Suggested fix:

Track removal of the exemption in an issue. Alternatively, once the cooldown window has passed for 21.14.12, regenerate the lock without the exemption, since 21.14.12 would then satisfy P7D.

@napetrov napetrov Oct 22, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed, it should not stay. virtualenv 21.14.12 was uploaded 2026-10-21T01:58Z, so it clears P7D on 2026-10-28. After that I will regenerate the lock without --exclude-newer-package=virtualenv=false and drop it from test_tools_lock_exempts_only_pins_younger_than_the_cooldown. That will be a follow-up PR, because without the exemption the lock cannot resolve to a fixed version today.

ast-serialize==0.13.0 \
--hash=sha256:017ddd4f22e727ef93e66df2d53340a6ff809b7e34cc2218f67918ae6239aad0 \
--hash=sha256:12441bc7e41e495db5634c98adc8f8886b619ce2f1e68effe3f792a2adca9f47 \
Expand Down Expand Up @@ -1611,9 +1611,9 @@ uv==0.13.4 \
--hash=sha256:e90ab42825587821096cb0d071e387468da38cfa22818c91f9c0b3c0453048e8 \
--hash=sha256:fb0e2028d9a8929884344afb7d91d0f65d9783f640d28aede89fca3602bedde9
# via -r requirements-ci.txt
virtualenv==21.14.7 \
--hash=sha256:3769219a308c5d2f093e7729621ad12a6346b5767a7ec4338414e2a0fb0c526b \
--hash=sha256:5f427d56f39eb7e7447d641dd4b7ab1e9c92793f498f35f26da2e4972c5546ae
virtualenv==21.14.12 \
--hash=sha256:7820aeaef23f1f59a96458edfc7f9d3deac937155718de15f1c9a64471e15551 \
--hash=sha256:bbcfb78e36c22ad70c6917c4aecb5e63477d3c138e9f88c946f320e31859c76a
# via pre-commit
zipp==4.1.1 ; python_full_version < '3.12' and platform_machine != 'ppc64le' and platform_machine != 's390x' \
--hash=sha256:7ebb7a44c021b29fd8dbd7cce6812d0d7b5b454521f93cc71af6ccd155aaa70b \
Expand Down
5 changes: 3 additions & 2 deletions dokimi/tests/test_dependency_locks.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -176,7 +176,8 @@ def test_lock_refresh_keeps_the_seven_day_cooldown(name: str) -> None:


def test_tools_lock_exempts_only_pins_younger_than_the_cooldown() -> None:
"""certifi comes from the main lock (a security bump) and uv is an exact pin in requirements-ci.txt."""
"""certifi comes from the main lock (a security bump), uv is an exact pin in requirements-ci.txt,
and virtualenv is a security bump (CVE-2026-113722)."""
cmd = header_command("requirements-ci.lock.txt")
exempt = {a.split("=", 1)[1] for a in cmd if a.startswith("--exclude-newer-package=")}
assert exempt == {"certifi=false", "uv=false"}, exempt
assert exempt == {"certifi=false", "uv=false", "virtualenv=false"}, exempt