[FIX] Bump Authlib 1.2.1 -> 1.6.12 & PyMySQL 1.1.0 -> 1.1.1 (clear critical Dependabot alerts) by jaseemjaskp · Pull Request #2041 · Zipstack/unstract

jaseemjaskp · Jun 11, 2026

What

Bumps two hard-pinned Python packages to clear their critical Dependabot alerts:

Authlib 1.2.1 → 1.6.12 (backend/pyproject.toml)
PyMySQL 1.1.0 → 1.1.1 (unstract/connectors/pyproject.toml)

Re-locks the affected workspaces: backend/uv.lock, unstract/connectors/uv.lock, workers/uv.lock, uv.lock.

Why

Authlib 1.2.1 carried the 🔴 critical JWS JWK header-injection signature-verification bypass, plus high-severity OIDC fail-open, JWE RSA1_5 Bleichenbacher padding oracle, unknown-crit-header bypass, and oversized-JOSE DoS. Notably, backend was the only place still on 1.2.1 — every other service in the monorepo already runs 1.6.12, so this just brings backend in line (no new Authlib version introduced).
PyMySQL 1.1.0 carried the 🔴 critical SQL-injection alert. It's pinned only in connectors, but appears (via unstract-connectors) in the backend/workers/root locks too — bumping the connectors pin propagates to all of them.

How

Edited both pins, then uv lock --upgrade-package for authlib/pymysql across backend, connectors, workers, and the root workspace.

Can this PR break any existing features. If yes, please list possible items. If no, please explain why. (PS: Admins do not merge the PR without this section filled)

PyMySQL is a patch bump (1.1.0 → 1.1.1) — negligible risk.

Authlib 1.2 → 1.6 is the one to watch. It's a multi-minor jump and backend's auth plugins import Authlib directly, so JWS/JWT/OIDC behaviour could shift. Mitigating factors:

Every other monorepo service already runs 1.6.12 successfully, and backend depends on those shared packages — so 1.6.x is already proven compatible with the shared code paths.
Backend lock diff is Authlib + PyMySQL only (no transitive churn); all four locks pass uv lock --check.

👉 Reviewers: please exercise the auth flows (login/OAuth/JWT) in CI/staging before merge — a local backend import smoke-test could not be run (backend env creation is blocked by an unrelated, pre-existing django-celery-beat==2.5.0 wheel packaging quirk that uv rejects).

Database Migrations

None.

Env Config

None.

Relevant Docs

Authlib changelog

Related Issues or PRs

Dependabot remediation series — follows #2038 (frontend), #2039 (Python transitive), #2040 (Django).

Dependencies Versions

Authlib 1.2.1 → 1.6.12 · PyMySQL 1.1.0 → 1.1.1

Notes on Testing

uv lock --check on backend / connectors / workers / root ✓
PyMySQL 1.1.1 install confirmed (uv pip show + pymysql.VERSION (1,1,1,'final',1)).
Authlib auth-flow testing to be done in CI/staging (local backend env blocked, see above).

Screenshots

N/A — dependency bump.

Checklist

I have read and understood the Contribution Guidelines.

…abot) Both were hard-pinned, so this updates the pins plus the affected locks. - Authlib (backend/pyproject.toml): 1.2.1 -> 1.6.12 — clears the critical JWS JWK header-injection signature-verification bypass, plus OIDC fail-open, JWE RSA1_5 Bleichenbacher oracle, unknown-crit-header bypass, and oversized-JOSE DoS. 1.6.12 matches the version every other service in the monorepo already runs (no third Authlib version introduced). - PyMySQL (unstract/connectors/pyproject.toml): 1.1.0 -> 1.1.1 — clears the critical SQL injection alert; propagated to backend, workers and root locks (they get PyMySQL via unstract-connectors). Verified: backend, connectors, workers and root locks pass 'uv lock --check'; backend lock diff is Authlib + PyMySQL only (no transitive churn); PyMySQL 1.1.1 confirmed installed (uv pip show + pymysql.VERSION). Note: Authlib 1.2 -> 1.6 is a multi-minor jump touching the backend auth plugins — auth flows must be exercised in CI/staging. Local backend import is blocked by the unrelated django-celery-beat 2.5.0 wheel quirk.

coderabbitai · Jun 11, 2026

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 955c241a-e842-435b-bbd5-52791e7289df

📥 Commits

Reviewing files that changed from the base of the PR and between 832c6d7 and 07f9d8f.

⛔ Files ignored due to path filters (4)

backend/uv.lock is excluded by !**/*.lock
unstract/connectors/uv.lock is excluded by !**/*.lock
uv.lock is excluded by !**/*.lock
workers/uv.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

backend/pyproject.toml

🚧 Files skipped from review as they are similar to previous changes (1)

backend/pyproject.toml

Summary by CodeRabbit

Chores
- Updated authentication library dependency to version 1.6.12
- Updated MySQL database connector dependency to version 1.1.1

Walkthrough

Two dependency version updates across separate project modules: Authlib upgraded from 1.2.1 to 1.6.12 in the backend, and PyMySQL upgraded from 1.1.0 to 1.1.1 in the connectors subsystem.

Changes

Dependency Version Updates

Layer / File(s)	Summary
Authlib backend auth dependency upgrade `backend/pyproject.toml`	Authlib dependency bumped from 1.2.1 to 1.6.12 in backend project dependencies for auth plugins.
PyMySQL connector dependency upgrade `unstract/connectors/pyproject.toml`	PyMySQL dependency upgraded from 1.1.0 to 1.1.1 in connectors module for MySQL connectivity.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The PR title clearly and specifically describes the main changes: bumping Authlib and PyMySQL versions and their purpose (clearing critical Dependabot alerts).
Description check	✅ Passed	The PR description is comprehensive and covers all required template sections with substantive content: What, Why, How, break analysis, database/env changes, docs, related issues, dependency versions, testing notes, and checklist completion.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/dependabot-authlib-pymysql

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

greptile-apps · Jun 11, 2026

Greptile Summary

This PR bumps two hard-pinned Python packages to clear critical Dependabot alerts: Authlib 1.2.1 → 1.6.12 in backend/pyproject.toml and PyMySQL 1.1.0 → 1.1.1 in unstract/connectors/pyproject.toml, with all four lock files re-generated.

Authlib bump closes five CVEs including the JWS/JWK header-injection signature-verification bypass. The backend's only direct usage is authlib.integrations.django_client.OAuth (stable API), and every other service in the monorepo was already on 1.6.12. Auth-flow testing in CI/staging is still recommended given the multi-minor version jump.
PyMySQL bump is a patch release closing a critical SQL-injection CVE; the change propagates cleanly through all four lock files with zero transitive churn (22 insertions, 22 deletions total across six files).

Confidence Score: 5/5

Safe to merge — this is a pure security-patch dependency bump with no logic changes and no transitive churn in any lock file.

Both packages are bumped solely to close known CVEs. The backend's direct Authlib usage is limited to the stable OAuth Django integration client, and every other service in the monorepo was already running Authlib 1.6.12 successfully. All four lock files were regenerated with uv lock --check passing and zero transitive package changes beyond the two bumped packages.

No files require special attention. Auth-flow testing in CI/staging before merge is advisable given the multi-minor Authlib version jump, but no code changes accompany the bump.

Important Files Changed

Filename	Overview
backend/pyproject.toml	Authlib pin bumped from 1.2.1 to 1.6.12 to clear critical Dependabot alerts; single-line change, correct.
unstract/connectors/pyproject.toml	PyMySQL pin bumped from 1.1.0 to 1.1.1 (patch bump, SQL-injection fix); single-line change, correct.
backend/uv.lock	Lock updated for Authlib 1.6.12 and PyMySQL 1.1.1; diff shows only 16 lines changed with no transitive churn.
unstract/connectors/uv.lock	Lock re-pinned for PyMySQL 1.1.1; 8-line diff, no unexpected transitive updates.
uv.lock	Root workspace lock re-pinned for PyMySQL 1.1.1 propagated from connectors; 8-line diff, no transitive churn.
workers/uv.lock	Workers lock re-pinned for PyMySQL 1.1.1; 8-line diff, no transitive churn.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[unstract/connectors/pyproject.toml\nPyMySQL 1.1.0 → 1.1.1] --> B[unstract/connectors/uv.lock]
    A --> C[backend/uv.lock\nvia unstract-connectors]
    A --> D[workers/uv.lock\nvia unstract-connectors]
    A --> E[uv.lock\nroot workspace]

    F[backend/pyproject.toml\nAuthlib 1.2.1 → 1.6.12] --> C

    B --> G{uv lock --check ✓}
    C --> G
    D --> G
    E --> G

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[unstract/connectors/pyproject.toml\nPyMySQL 1.1.0 → 1.1.1] --> B[unstract/connectors/uv.lock]
    A --> C[backend/uv.lock\nvia unstract-connectors]
    A --> D[workers/uv.lock\nvia unstract-connectors]
    A --> E[uv.lock\nroot workspace]

    F[backend/pyproject.toml\nAuthlib 1.2.1 → 1.6.12] --> C

    B --> G{uv lock --check ✓}
    C --> G
    D --> G
    E --> G

_{Reviews (3): Last reviewed commit: "Merge branch 'main' into fix/dependabot-..." | Re-trigger Greptile}

coderabbitai

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@backend/pyproject.toml`:
- Line 16: You upgraded Authlib to 1.6.12 which crosses several breaking
changes; either pin the dependency to a safe tested version (e.g., maintain
1.2.x) or run and update our auth/OIDC/JWT codepaths: audit usages of
has_client_secret, request_invalid, token_revoked, ClientSecretJWT.sign,
InvalidGrantError handling, OpenIDImplicitGrant/OpenIDHybridGrant redirect_uri
behavior, any custom OAuth2AuthorizationCodeMixin code, and authlib.jose.jwt
JWE/JWT algorithm handling (and check Python 3.8 support), then update
callers/handlers and tests to match the new APIs before merging.

In `@unstract/connectors/pyproject.toml`:
- Line 42: Replace the pinned dependency string "PyMySQL==1.1.1" with the
current release "PyMySQL==1.2.0" in the project's pyproject.toml dependency list
to move to the latest patched version; update any lockfile or regenerate
dependencies (e.g., poetry lock / pip-compile) and run tests to ensure
compatibility with the bumped PyMySQL version.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 333dd116-6685-468e-b889-77e66a13d338

📥 Commits

Reviewing files that changed from the base of the PR and between cafcca7 and 832c6d7.

⛔ Files ignored due to path filters (4)

backend/uv.lock is excluded by !**/*.lock
unstract/connectors/uv.lock is excluded by !**/*.lock
uv.lock is excluded by !**/*.lock
workers/uv.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

backend/pyproject.toml
unstract/connectors/pyproject.toml

jaseemjaskp

Automated dependency-review pass (PR Review Toolkit). The PR surface is dependency-version bumps + regenerated lock files only — no application code — so the code-quality/type/test/comment agents have no surface to analyze. One additive note below; the existing CodeRabbit notes on the Authlib and PyMySQL breaking-change concerns stand and are not duplicated here.

sonarqubecloud · Jun 18, 2026

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

github-actions · Jun 18, 2026

Unstract test results

Per-group results

Status	Group	Tier	Passed	Failed	Errors	Skipped	Duration (s)
❌	`unit-connectors`	unit	64	12	0	3	16.7
❌	`unit-core`	unit	0	0	4	0	1.1
❌	`unit-platform-service`	unit	9	0	1	0	1.3
✅	`unit-prompt-service`	unit	15	0	0	0	20.0
✅	`unit-rig`	unit	53	0	0	0	3.2
✅	`unit-runner`	unit	11	0	0	0	3.1
✅	`unit-sdk1`	unit	390	0	0	0	20.6
❌	`unit-tool-registry`	unit	0	0	1	0	1.2
⚪	`unit-workers`	unit	0	0	0	0	17.4
	TOTAL		542	12	6	3	84.8

Critical paths

⚠️ Critical paths not yet covered

auth-login — User can log in and obtain a session cookie. (entry: POST /api/v1/auth/login; declared coverage: no groups declared)
adapter-register-llm — Register and validate an LLM adapter. (entry: POST /api/v1/adapter/; declared coverage: no groups declared)
workflow-create-execute — Create a workflow, configure source+destination, execute, poll, fetch result. (entry: POST /api/v1/workflow/{id}/execute/; declared coverage: e2e-workflow)
api-deployment-run — Deploy a workflow as an API, POST a document, receive structured JSON. (entry: POST /deployment/api/{org}/{name}/; declared coverage: e2e-api-deployment)
prompt-studio-fetch-response — Prompt Studio: create project, add prompt, run single-pass, get response. (entry: POST /api/v1/prompt-studio/prompt-studio-tool/{id}/fetch_response/; declared coverage: e2e-prompt-studio)
pipeline-etl-execute — Run an ETL pipeline from source connector to destination. (entry: POST /api/v1/pipeline/{id}/execute/; declared coverage: no groups declared)
usage-token-tracking — Per-execution token usage is recorded and retrievable. (entry: GET /api/v1/usage/get_token_usage/; declared coverage: no groups declared)
workflow-execution-fan-out — Multi-file workflow execution fans out to file-processing workers and rejoins. (entry: internal: backend → rabbitmq → workers/file_processing; declared coverage: no groups declared)
callback-result-delivery — Async results are posted back via the callback worker. (entry: internal: workers/callback → backend /internal endpoints; declared coverage: no groups declared)

✅ Covered critical paths

tool-sandbox-exec — covered by unit-runner

coderabbitai Bot reviewed Jun 11, 2026

View reviewed changes

Comment thread backend/pyproject.toml

Comment thread unstract/connectors/pyproject.toml

jaseemjaskp mentioned this pull request Jun 11, 2026

[FIX] Unblock urllib3 2.x via google-auth bump (clear urllib3 Dependabot alerts) #2042

Merged

jaseemjaskp requested a review from muhammad-ali-e June 18, 2026 11:09

Merge branch 'main' into fix/dependabot-authlib-pymysql

07f9d8f

jaseemjaskp commented Jun 18, 2026

View reviewed changes

Comment thread backend/pyproject.toml

jaseemjaskp requested a review from hari-kuriakose June 18, 2026 14:54

Merge branch 'main' into fix/dependabot-authlib-pymysql

69c0467

jaseemjaskp merged commit 3b08df2 into main Jun 18, 2026
10 checks passed

jaseemjaskp deleted the fix/dependabot-authlib-pymysql branch June 18, 2026 17:13

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[FIX] Bump Authlib 1.2.1 -> 1.6.12 & PyMySQL 1.1.0 -> 1.1.1 (clear critical Dependabot alerts)#2041

[FIX] Bump Authlib 1.2.1 -> 1.6.12 & PyMySQL 1.1.0 -> 1.1.1 (clear critical Dependabot alerts)#2041
jaseemjaskp merged 3 commits into
mainZipstack/unstract:mainfrom
fix/dependabot-authlib-pymysqlZipstack/unstract:fix/dependabot-authlib-pymysqlCopy head branch name to clipboard

jaseemjaskp commented Jun 11, 2026

Uh oh!

coderabbitai Bot commented Jun 11, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Jun 11, 2026 •

edited

Loading

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Flowchart

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

jaseemjaskp left a comment

Uh oh!

Uh oh!

sonarqubecloud Bot commented Jun 18, 2026

Uh oh!

github-actions Bot commented Jun 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Search code, repositories, users, issues, pull requests...

Uh oh!

Conversation

jaseemjaskp commented Jun 11, 2026

What

Why

How

Can this PR break any existing features. If yes, please list possible items. If no, please explain why. (PS: Admins do not merge the PR without this section filled)

Database Migrations

Env Config

Relevant Docs

Related Issues or PRs

Dependencies Versions

Notes on Testing

Screenshots

Checklist

Uh oh!

coderabbitai Bot commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Changes

Estimated code review effort

Uh oh!

greptile-apps Bot commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Flowchart

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

jaseemjaskp left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sonarqubecloud Bot commented Jun 18, 2026

Quality Gate passed

Uh oh!

github-actions Bot commented Jun 18, 2026

Unstract test results

Per-group results

Critical paths

⚠️ Critical paths not yet covered

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Jun 11, 2026 •

edited

Loading

greptile-apps Bot commented Jun 11, 2026 •

edited

Loading