[FIX] Unblock urllib3 2.x via google-auth bump (clear urllib3 Dependabot alerts) by jaseemjaskp · Pull Request #2042 · Zipstack/unstract

jaseemjaskp · Jun 11, 2026

What

Unblocks urllib3 1.26.20 → 2.7.0 across root / backend / workers / connectors by lifting the constraint that pinned it to the 1.x line.

unstract/connectors/pyproject.toml: google-auth==2.20.0 → google-auth>=2.22.0
uv.lock, backend/uv.lock, workers/uv.lock, unstract/connectors/uv.lock: urllib3 → 2.7.0, google-auth → 2.53.0 (cachetools dropped — no longer a hard dep of google-auth 2.53)

Why

urllib3 was held at 1.26.20 everywhere, and its CVEs (sensitive-header leakage across redirects, decompression-bomb bypass, unbounded decompression chain) have no 1.26.x patch — the fixes exist only in 2.x. The resolver was capped by a single pin: google-auth==2.20.0, which declares urllib3<2.0. google-auth>=2.22.0 removed that cap, so urllib3 resolves to 2.7.0 and the alerts clear. It was the only urllib3<2 constraint in the graph (verified by forcing urllib3>=2.7.0 and reading the resolver conflict).

How

Diagnosed the cap by forcing urllib3>=2.7.0 into the resolver until it named google-auth==2.20.0.
Bumped only the google-auth lower bound (left google-cloud-bigquery pinned, since the remaining protobuf cap is separate — see below).
>= matches existing repo style (boto3~=, httpx>=, croniter>=, …).

Can this PR break any existing features. If yes, please list possible items. If no, please explain why. (PS: Admins do not merge the PR without this section filled)

This is the highest-risk PR in the Dependabot series and should get real integration testing before merge. It changes the HTTP layer (urllib3 1.x → 2.x) and the GCP auth library (google-auth 2.20 → 2.53), both used across the cloud connectors (GCS, BigQuery, GCP-auth) and anything doing HTTP via requests/botocore/etc.

Mitigating evidence:

Tiny, surgical diff — 3 packages per lock (urllib3 ↑, google-auth ↑, cachetools removed). No wider cascade.
All 4 locks pass uv lock --check.
Connectors env smoke test: urllib3 2.7.0, google.auth, google.cloud.bigquery, pymysql all import cleanly.
urllib3 2.x is mature; google-auth 2.20→2.53 stays within the same major.

👉 Please exercise the cloud connectors (GCS / BigQuery / GCP auth) and any outbound-HTTP paths in CI/staging. A full local run isn't possible (backend env blocked by the unrelated django-celery-beat 2.5.0 wheel quirk); connectors-level imports are verified but live auth/transfer flows are not.

Consider merging this after the lower-risk Dependabot PRs (#2038–#2041) land.

Database Migrations

None.

Env Config

None.

Relevant Docs

urllib3 2.0 migration guide · google-auth changelog

Related Issues or PRs

Final PR of the Dependabot remediation series (#2038 frontend, #2039 python-transitive, #2040 Django, #2041 Authlib/PyMySQL).

Deferred — protobuf 5.x

protobuf is still capped <5 by additional google/grpc libraries (beyond google-cloud-bigquery, which this PR leaves pinned), and 4 → 5 is a major-version jump. It stays on the 4.25.x LTS line (latest patch), which carries the relevant backported fixes. Moving to 5.x warrants its own PR with a coordinated google-cloud / grpcio upgrade + testing.

Dependencies Versions

urllib3 1.26.20 → 2.7.0 · google-auth 2.20.0 → 2.53.0

Notes on Testing

uv lock --check on all 4 workspaces ✓
Connectors import smoke test (urllib3 / google.auth / bigquery / pymysql) ✓
Live cloud-connector + HTTP integration testing to be done in CI/staging.

Screenshots

N/A — dependency change.

Checklist

I have read and understood the Contribution Guidelines.

…ndabot alerts) urllib3 was held at 1.26.20 across root/backend/workers/connectors because google-auth==2.20.0 (pinned in unstract-connectors) requires urllib3<2.0. google-auth>=2.22.0 drops that cap, letting urllib3 resolve to 2.7.0 and clearing the urllib3 high-severity alerts (header leakage on redirects, decompression-bomb bypass, unbounded decompression chain). - unstract/connectors/pyproject.toml: google-auth==2.20.0 -> >=2.22.0 - root/backend/workers/connectors uv.lock: urllib3 1.26.20 -> 2.7.0, google-auth 2.20.0 -> 2.53.0 (cachetools dropped — no longer a hard dep of google-auth 2.53) Verified: all 4 locks pass 'uv lock --check'; connectors env smoke test imports urllib3 2.7.0, google.auth, google.cloud.bigquery, pymysql cleanly. Deferred (NOT in this PR): protobuf 5.x is still capped <5 by additional google/grpc libraries (beyond google-cloud-bigquery) and is a major-version jump; protobuf stays on the 4.25.x LTS line for now.

coderabbitai · Jun 11, 2026

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 26b12f8e-a802-4e45-b085-965fc6b2c34a

📥 Commits

Reviewing files that changed from the base of the PR and between 581f857 and f6fbaf1.

⛔ Files ignored due to path filters (4)

backend/uv.lock is excluded by !**/*.lock
unstract/connectors/uv.lock is excluded by !**/*.lock
uv.lock is excluded by !**/*.lock
workers/uv.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

unstract/connectors/pyproject.toml

🚧 Files skipped from review as they are similar to previous changes (1)

unstract/connectors/pyproject.toml

Summary by CodeRabbit

Chores
- Updated google-auth dependency version constraints to support a broader range of versions and enable compatibility with urllib3 2.x.

Walkthrough

The PR updates the google-auth dependency in the connectors package from a pinned version 2.20.0 to a relaxed lower-bounded constraint >=2.22.0,<3. This change permits usage of google-auth versions 2.22.0 and above, removing the implicit urllib3<2 constraint that was present in version 2.20.0.

Changes

Dependency Version Constraint

Layer / File(s)	Summary
Update google-auth to >=2.22.0,<3 `unstract/connectors/pyproject.toml`	The `google-auth` dependency is relaxed from exact pinning at `2.20.0` to a bounded requirement `>=2.22.0,<3`, with an inline comment noting that newer google-auth versions (notably >=2.53) no longer depend on `urllib3`.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: unblocking urllib3 2.x by bumping google-auth, which directly addresses the PR's primary objective.
Description check	✅ Passed	The PR description is comprehensive and complete, covering all required template sections with detailed context about the change, rationale, risk assessment, and testing.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/dependabot-urllib3-protobuf

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@unstract/connectors/pyproject.toml`:
- Line 25: Update the inline comment on the dependency entry
"google-auth>=2.22.0" to remove the incorrect claim that it “drops the urllib3<2
cap” (google-auth==2.22.0 still pins urllib3<2.0); instead note that upgrading
to a google-auth version that truly allows urllib3>=2 is required to lift that
cap. Also audit any direct use of urllib3.util.Retry in your codebase: replace
deprecated parameters such as method_whitelist with allowed_methods and update
any references to renamed DEFAULT_* constants to their urllib3 2.0 equivalents
so Retry construction is compatible with urllib3 2.x.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: af6aa938-a3c3-4f3f-9c8b-3f917ffdf9f4

📥 Commits

Reviewing files that changed from the base of the PR and between cafcca7 and 41c9503.

⛔ Files ignored due to path filters (4)

backend/uv.lock is excluded by !**/*.lock
unstract/connectors/uv.lock is excluded by !**/*.lock
uv.lock is excluded by !**/*.lock
workers/uv.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

unstract/connectors/pyproject.toml

greptile-apps · Jun 11, 2026

Greptile Summary

This PR unblocks urllib3 2.x across all four workspace lock files by lifting the google-auth==2.20.0 pin (which declared urllib3<2) to google-auth>=2.22.0,<3. The resolver then picks google-auth 2.55.0 and urllib3 2.7.0, clearing the open Dependabot CVE alerts.

unstract/connectors/pyproject.toml: sole source change — version specifier loosened from exact pin to a compatible range.
All four uv.lock files updated consistently: google-auth 2.20.0 → 2.55.0, urllib3 1.26.20 → 2.7.0, cachetools removed (no longer a transitive dep of google-auth 2.55), cryptography added as a new google-auth dep (replacing rsa).
No application code changes; no direct urllib3 or cachetools imports found in the connectors source tree. Note: the PR description references "google-auth → 2.53.0" but all lock files resolve to 2.55.0 (the latest at lock-regeneration time).

Confidence Score: 5/5

Safe to merge after integration testing of GCS/BigQuery/GCP-auth paths in CI/staging, as recommended in the PR description.

The change is purely a dependency version update with no application code touched. urllib3 has no direct imports in the connectors source tree, cachetools is not directly imported anywhere, and the four lock files are internally consistent. The main runtime risk — urllib3 1.x → 2.x breaking changes — is real but confined to any code that uses deprecated 1.x APIs indirectly; the connectors code does not import urllib3 directly.

No files require special attention beyond the minor comment inaccuracy in unstract/connectors/pyproject.toml.

Important Files Changed

Filename	Overview
unstract/connectors/pyproject.toml	Loosens google-auth pin from ==2.20.0 to >=2.22.0,<3 with an explanatory comment; minor version note inaccuracy in the inline comment (says >=2.53, lock resolves 2.55.0, minimum floor is 2.22.0).
backend/uv.lock	google-auth bumped 2.20.0→2.55.0, urllib3 bumped 1.26.20→2.7.0, cachetools removed (no longer a transitive dep of google-auth 2.55); cryptography added as google-auth dep.
unstract/connectors/uv.lock	Same three-package change as backend: google-auth 2.55.0, urllib3 2.7.0, cachetools removed; lock is internally consistent.
uv.lock	Root workspace lock updated consistently with the same three-package change; no unexpected cascade.
workers/uv.lock	Workers lock updated consistently; same surgical three-package change as the other three lock files.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["pyproject.toml\ngoogle-auth ==2.20.0\n(urllib3<2 cap)"] -->|"Bump to >=2.22.0,<3"| B["google-auth 2.55.0\n(no urllib3<2 constraint)"]
    B --> C["urllib3 2.7.0\n(CVEs cleared)"]
    B --> D["cryptography added\n(replaces rsa)"]
    B --> E["cachetools removed\n(no longer required)"]
    C --> F["All 4 uv.lock files\nbackend / connectors\nworkers / root"]

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A["pyproject.toml\ngoogle-auth ==2.20.0\n(urllib3<2 cap)"] -->|"Bump to >=2.22.0,<3"| B["google-auth 2.55.0\n(no urllib3<2 constraint)"]
    B --> C["urllib3 2.7.0\n(CVEs cleared)"]
    B --> D["cryptography added\n(replaces rsa)"]
    B --> E["cachetools removed\n(no longer required)"]
    C --> F["All 4 uv.lock files\nbackend / connectors\nworkers / root"]

_{Reviews (4): Last reviewed commit: "Merge branch 'main' into fix/dependabot-..." | Re-trigger Greptile}

jaseemjaskp

Automated review (PR Review Toolkit). This is a clean, internally-consistent dependency bump; the 4 lock files match each other and the pyproject change, and platform-service/prompt-service/sdk1 were correctly left untouched (they already resolve urllib3 2.7.0). One line carries two minor, non-blocking points below — distinct from the floor-version question @coderabbitai already raised.

Address PR review: the '>=2.22 drops urllib3<2 cap' comment was wrong (2.22.0 still pins urllib3<2; google-auth 2.53 resolved in lock has no urllib3 dep at all). Also cap the only unbounded specifier in the block.

…3-protobuf # Conflicts: # backend/uv.lock # unstract/connectors/uv.lock # uv.lock # workers/uv.lock

github-actions · Jun 18, 2026

Unstract test results

Per-group results

Status	Group	Tier	Passed	Failed	Errors	Skipped	Duration (s)
❌	`unit-connectors`	unit	64	12	0	3	16.9
❌	`unit-core`	unit	0	0	4	0	1.2
❌	`unit-platform-service`	unit	9	0	1	0	1.4
✅	`unit-prompt-service`	unit	15	0	0	0	20.1
✅	`unit-rig`	unit	53	0	0	0	3.4
✅	`unit-runner`	unit	11	0	0	0	3.1
✅	`unit-sdk1`	unit	390	0	0	0	20.2
❌	`unit-tool-registry`	unit	0	0	1	0	1.3
⚪	`unit-workers`	unit	0	0	0	0	17.7
	TOTAL		542	12	6	3	85.2

Critical paths

⚠️ Critical paths not yet covered

auth-login — User can log in and obtain a session cookie. (entry: POST /api/v1/auth/login; declared coverage: no groups declared)
adapter-register-llm — Register and validate an LLM adapter. (entry: POST /api/v1/adapter/; declared coverage: no groups declared)
workflow-create-execute — Create a workflow, configure source+destination, execute, poll, fetch result. (entry: POST /api/v1/workflow/{id}/execute/; declared coverage: e2e-workflow)
api-deployment-run — Deploy a workflow as an API, POST a document, receive structured JSON. (entry: POST /deployment/api/{org}/{name}/; declared coverage: e2e-api-deployment)
prompt-studio-fetch-response — Prompt Studio: create project, add prompt, run single-pass, get response. (entry: POST /api/v1/prompt-studio/prompt-studio-tool/{id}/fetch_response/; declared coverage: e2e-prompt-studio)
pipeline-etl-execute — Run an ETL pipeline from source connector to destination. (entry: POST /api/v1/pipeline/{id}/execute/; declared coverage: no groups declared)
usage-token-tracking — Per-execution token usage is recorded and retrievable. (entry: GET /api/v1/usage/get_token_usage/; declared coverage: no groups declared)
workflow-execution-fan-out — Multi-file workflow execution fans out to file-processing workers and rejoins. (entry: internal: backend → rabbitmq → workers/file_processing; declared coverage: no groups declared)
callback-result-delivery — Async results are posted back via the callback worker. (entry: internal: workers/callback → backend /internal endpoints; declared coverage: no groups declared)

✅ Covered critical paths

tool-sandbox-exec — covered by unit-runner

sonarqubecloud · Jun 19, 2026

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

coderabbitai Bot reviewed Jun 11, 2026

View reviewed changes

Comment thread unstract/connectors/pyproject.toml Outdated

jaseemjaskp requested review from chandrasekharan-zipstack and muhammad-ali-e June 11, 2026 15:43

jaseemjaskp commented Jun 12, 2026

View reviewed changes

Comment thread unstract/connectors/pyproject.toml Outdated

jaseemjaskp and others added 4 commits June 18, 2026 16:43

[FIX] Correct google-auth comment + add upper bound (<3)

dfea896

Address PR review: the '>=2.22 drops urllib3<2 cap' comment was wrong (2.22.0 still pins urllib3<2; google-auth 2.53 resolved in lock has no urllib3 dep at all). Also cap the only unbounded specifier in the block.

Commit uv.lock changes

581f857

Merge remote-tracking branch 'origin/main' into fix/dependabot-urllib…

7ca9b90

…3-protobuf # Conflicts: # backend/uv.lock # unstract/connectors/uv.lock # uv.lock # workers/uv.lock

Merge branch 'main' into fix/dependabot-urllib3-protobuf

f6fbaf1

muhammad-ali-e approved these changes Jun 19, 2026

View reviewed changes

jaseemjaskp merged commit f0321e6 into main Jun 19, 2026
10 checks passed

jaseemjaskp deleted the fix/dependabot-urllib3-protobuf branch June 19, 2026 04:46

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[FIX] Unblock urllib3 2.x via google-auth bump (clear urllib3 Dependabot alerts)#2042

[FIX] Unblock urllib3 2.x via google-auth bump (clear urllib3 Dependabot alerts)#2042
jaseemjaskp merged 5 commits into
mainZipstack/unstract:mainfrom
fix/dependabot-urllib3-protobufZipstack/unstract:fix/dependabot-urllib3-protobufCopy head branch name to clipboard

jaseemjaskp commented Jun 11, 2026

Uh oh!

coderabbitai Bot commented Jun 11, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

greptile-apps Bot commented Jun 11, 2026 •

edited

Loading

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Flowchart

Uh oh!

jaseemjaskp left a comment

Uh oh!

Uh oh!

github-actions Bot commented Jun 18, 2026

Uh oh!

Uh oh!

sonarqubecloud Bot commented Jun 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Search code, repositories, users, issues, pull requests...

Uh oh!

Conversation

jaseemjaskp commented Jun 11, 2026

What

Why

How

Can this PR break any existing features. If yes, please list possible items. If no, please explain why. (PS: Admins do not merge the PR without this section filled)

Database Migrations

Env Config

Relevant Docs

Related Issues or PRs

Deferred — protobuf 5.x

Dependencies Versions

Notes on Testing

Screenshots

Checklist

Uh oh!

coderabbitai Bot commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Changes

Estimated code review effort

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

greptile-apps Bot commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Flowchart

Uh oh!

jaseemjaskp left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented Jun 18, 2026

Unstract test results

Per-group results

Critical paths

⚠️ Critical paths not yet covered

Uh oh!

Uh oh!

sonarqubecloud Bot commented Jun 19, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai Bot commented Jun 11, 2026 •

edited

Loading

greptile-apps Bot commented Jun 11, 2026 •

edited

Loading