Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Add explicit idna>=3.15 constraint for SDK wrapper requirements - #3861

#3861
Open
plengauer with Copilot wants to merge 2 commits into
mainplengauer/Thoth:mainfrom
copilot/bump-idna-to-315plengauer/Thoth:copilot/bump-idna-to-315Copy head branch name to clipboard
Open

Add explicit idna>=3.15 constraint for SDK wrapper requirements#3861
plengauer with Copilot wants to merge 2 commits into
mainplengauer/Thoth:mainfrom
copilot/bump-idna-to-315plengauer/Thoth:copilot/bump-idna-to-315Copy head branch name to clipboard

Conversation

Copilot AI commented Jul 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

osv-scanner reported the SDK wrapper Python requirements as vulnerable due to idna resolving below the fixed version for PYSEC-2026-215 / GHSA-65pc-fj4g-8rjx. This change constrains that dependency to a non-vulnerable release line.

  • Dependency constraint

    • Add an explicit idna>=3.15 requirement to src/opt/opentelemetry_shell/requirements.txt
    • Keep the change scoped to the affected SDK wrapper requirements file

  • Effect on resolution

    • Ensure environments installing this requirements set resolve idna from the fixed range instead of allowing vulnerable versions
requests==2.34.2
idna>=3.15
opentelemetry-sdk==1.44.0

@plengauer

plengauer commented Jul 25, 2026

Copy link
Copy Markdown
Owner

Hello, thanks for contributing for the first time!

Copilot AI linked an issue Jul 25, 2026 that may be closed by this pull request
[MegaLinter][valid][security] idna 3.9.0 has a known CVE — bump to >=3.15 #3835
Open
@github-actions

github-actions Bot commented Jul 25, 2026 •
edited
Loading

Copy link
Copy Markdown

❌MegaLinter analysis: Error

Descriptor Linter Files Fixed Errors Warnings Elapsed time
❌ COPYPASTE jscpd yes 70 no 1.4s
✅ REPOSITORY betterleaks yes no no 5.02s
✅ REPOSITORY checkov yes no no 28.83s
❌ REPOSITORY devskim yes 2027 185 133.61s
✅ REPOSITORY dustilock yes no no 1.21s
✅ REPOSITORY gitleaks yes no no 71.31s
✅ REPOSITORY git_diff yes no no 0.17s
❌ REPOSITORY grype yes 2 no 114.33s
❌ REPOSITORY kingfisher yes 1 4 22.77s
❌ REPOSITORY osv-scanner yes 2 no 1.39s
✅ REPOSITORY secretlint yes no no 4.67s
✅ REPOSITORY syft yes no no 8.7s
❌ REPOSITORY trivy yes 11 6 11.3s
✅ REPOSITORY trivy-sbom yes no no 1.13s
✅ REPOSITORY trufflehog yes no no 4.76s
❌ SPELL cspell 2 4 0 3.64s
✅ SPELL lychee 1 0 0 0.11s

Detailed Issues

❌ SPELL / cspell - 4 errors 
src/opt/opentelemetry_shell/requirements.txt:2:1       - Unknown word (idna)       -- idna>=3.15
	 Suggestions: [dina, iana, idea, iona, Iona]
src/opt/opentelemetry_shell/requirements.txt:5:15      - Unknown word (resourcedetector) -- opentelemetry-resourcedetector-docker==0.4.0
	 Suggestions: []
src/opt/opentelemetry_shell/requirements.txt:6:15      - Unknown word (resourcedetector) -- opentelemetry-resourcedetector-kubernetes==0.3.0
	 Suggestions: []
src/opt/opentelemetry_shell/requirements.txt:9:15      - Unknown word (resourcedetector) -- opentelemetry-resourcedetector-gcp==1.12.0a0
	 Suggestions: []
CSpell: Files checked: 2, Issues found: 4 in 1 file.


You can skip this misspellings by defining the following .cspell.json file at the root of your repository
Of course, please correct real typos before :)

{
    "version": "0.2",
    "language": "en",
    "ignorePaths": [
        "**/node_modules/**",
        "**/vscode-extension/**",
        "**/.git/**",
        "**/.pnpm-lock.json",
        ".vscode",
        "package-lock.json",
        "megalinter-reports"
    ],
    "words": [
        "idna",
        "resourcedetector"
    ]
}


You can also copy-paste megalinter-reports/.cspell.json at the root of your repository
❌ REPOSITORY / devskim - 2027 errors

No output available

❌ REPOSITORY / grype - 2 errors

No output available

❌ COPYPASTE / jscpd - 70 errors 
ion.http/agent.injection.http_header.c [192:106 - 198:25]
Clone found (c)
 - src/usr/share/opentelemetry_shell/agent.instrumentation.http/agent.injection.http_header.c [175:77 - 181:25] (7 lines, 52 tokens)
   src/usr/share/opentelemetry_shell/agent.instrumentation.http/agent.injection.http_header.c [209:102 - 215:25]
Clone found (java)
 - src/usr/share/opentelemetry_shell/agent.instrumentation.java/GradleHttpPropagationAgent.java [13:75 - 18:7] (6 lines, 75 tokens)
   src/usr/share/opentelemetry_shell/agent.instrumentation.java/RootContextAgent.java [3:73 - 9:7]
Clone found (javascript)
 - src/usr/share/opentelemetry_shell/agent.instrumentation.node/deep.instrument.js [15:1 - 36:2] (22 lines, 141 tokens)
   src/usr/share/opentelemetry_shell/agent.instrumentation.node/deep.link.js [11:1 - 32:2]
Clone found (bash)
 - src/usr/share/opentelemetry_shell/agent.instrumentation.wget.sh [97:114 - 104:29] (8 lines, 56 tokens)
   src/usr/share/opentelemetry_shell/agent.instrumentation.wget.sh [181:72 - 188:29]
Clone found (bash)
 - src/usr/share/opentelemetry_shell/agent.instrumentation.wget.sh [118:9 - 124:90] (7 lines, 57 tokens)
   src/usr/share/opentelemetry_shell/agent.instrumentation.wget.sh [129:7 - 135:88]
Clone found (bash)
 - src/usr/share/opentelemetry_shell/agent.sh [343:19 - 356:2] (14 lines, 59 tokens)
   src/usr/share/opentelemetry_shell/agent.sh [362:27 - 375:2]
Clone found (python)
 - src/usr/share/opentelemetry_shell/sdk.py [65:9 - 87:42] (23 lines, 141 tokens)
   src/usr/share/opentelemetry_shell/sdk.py [105:9 - 128:37]
Clone found (bash)
 - tests/assert.sh [37:45 - 54:8] (18 lines, 79 tokens)
   tests/assert.sh [54:44 - 71:8]
Clone found (bash)
 - tests/auto/test_auto_curl.sh [7:45 - 17:14] (11 lines, 97 tokens)
   tests/auto/test_auto_wget.sh [9:50 - 18:14]
Clone found (bash)
 - tests/auto/test_auto_curl.sh [12:1 - 17:14] (6 lines, 62 tokens)
   tests/auto/test_auto_curl.sh [66:1 - 71:14]
Clone found (bash)
 - tests/auto/test_auto_curl.sh [17:43 - 22:89] (6 lines, 60 tokens)
   tests/auto/test_auto_curl.sh [71:41 - 76:89]
Clone found (bash)
 - tests/auto/test_auto_curl.sh [19:19 - 25:84] (7 lines, 80 tokens)
   tests/auto/test_auto_curl.sh [39:29 - 45:84]
Clone found (bash)
 - tests/auto/test_auto_curl.sh [30:61 - 35:14] (6 lines, 54 tokens)
   tests/auto/test_auto_curl.sh [64:68 - 69:14]
Clone found (bash)
 - tests/auto/test_auto_curl.sh [32:1 - 37:14] (6 lines, 62 tokens)
   tests/auto/test_auto_wget.sh [32:1 - 37:14]
Clone found (bash)
 - tests/auto/test_auto_curl.sh [49:1 - 54:14] (6 lines, 62 tokens)
   tests/auto/test_auto_wget.sh [49:1 - 54:14]
Clone found (bash)
 - tests/auto/test_auto_injection_node.sh [67:1 - 79:26] (13 lines, 65 tokens)
   tests/auto/test_auto_injection_node.sh [98:1 - 110:26]
Clone found (bash)
 - tests/auto/test_auto_injection_node.sh [80:1 - 98:6] (19 lines, 117 tokens)
   tests/auto/test_auto_injection_node.sh [112:1 - 130:6]
Clone found (bash)
 - tests/auto/test_auto_injection_node.sh [109:9 - 115:14] (7 lines, 54 tokens)
   tests/auto/test_auto_injection_node.sh [135:2 - 141:14]
Clone found (bash)
 - tests/auto/test_auto_netcat.sh [98:19 - 104:193] (7 lines, 69 tokens)
   tests/auto/test_auto_netcat.sh [109:33 - 115:193]
Clone found (bash)
 - tests/auto/test_auto_wget.sh [20:19 - 28:37] (9 lines, 92 tokens)
   tests/auto/test_auto_wget.sh [39:29 - 48:20]
┌────────────┬────────────────┬─────────────┬──────────────┬──────────────┬──────────────────┬───────────────────┐
│ Format     │ Files analyzed │ Total lines │ Total tokens │ Clones found │ Duplicated lines │ Duplicated tokens │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ bash       │ 108            │ 8288        │ 58528        │ 58           │ 605 (7.30%)      │ 5907 (10.09%)     │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ c          │ 2              │ 334         │ 2652         │ 4            │ 26 (7.78%)       │ 236 (8.90%)       │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ java       │ 6              │ 313         │ 2886         │ 2            │ 10 (3.19%)       │ 142 (4.92%)       │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ javascript │ 9              │ 296         │ 2690         │ 5            │ 69 (23.31%)      │ 632 (23.49%)      │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ kotlin     │ 2              │ 57          │ 703          │ 0            │ 0 (0.00%)        │ 0 (0.00%)         │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ python     │ 3              │ 733         │ 5265         │ 1            │ 22 (3.00%)       │ 141 (2.68%)       │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ txt        │ 2              │ 17          │ 138          │ 0            │ 0 (0.00%)        │ 0 (0.00%)         │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ Total:     │ 132            │ 10038       │ 72862        │ 70           │ 732 (7.29%)      │ 7058 (9.69%)      │
└────────────┴────────────────┴─────────────┴──────────────┴──────────────┴──────────────────┴───────────────────┘
Found 70 clones.
HTML report saved to megalinter-reports/copy-paste/jscpd-report.html
ERROR: jscpd found too many duplicates (7.3%) over threshold (0.0%)
time: 232.522ms

(Truncated to last 5714 characters out of 14586)
❌ REPOSITORY / kingfisher - 1 error

No output available

❌ REPOSITORY / osv-scanner - 2 errors 
Scanning dir .
Starting filesystem walk for root: /
Scanned src/opt/opentelemetry_shell/requirements.txt file and found 9 packages
Scanned src/usr/share/opentelemetry_shell/agent.instrumentation.java/pom.xml file and found 2 packages
Scanned src/usr/share/opentelemetry_shell/agent.instrumentation.python/requirements.txt file and found 8 packages
Scanned src/usr/share/opentelemetry_shell/agent.instrumentation.python/instrumentation_roots_requirements.txt file and found 2 packages
Scanned actions/instrument/job/package-lock.json file and found 157 packages
End status: 92 dirs visited, 528 inodes visited, 5 Extract calls, 45.492217ms elapsed, 45.492417ms wall time
Warning: enricher transitivedependency/pomxml may be risky when run on untrusted artifacts. Please ensure you trust the source code and artifacts.
failed resolution for src/usr/share/opentelemetry_shell/agent.instrumentation.java/pom.xml: failed resolving {Maven:dummy:dummy[Concrete:0] {}}: rpc error: code = Unavailable desc = service unavailable
failed resolution for src/usr/share/opentelemetry_shell/agent.instrumentation.python/instrumentation_roots_requirements.txt: rpc error: code = Unavailable desc = service unavailable
failed resolution for src/opt/opentelemetry_shell/requirements.txt: rpc error: code = Unavailable desc = service unavailable
failed resolution for src/usr/share/opentelemetry_shell/agent.instrumentation.python/requirements.txt: rpc error: code = Unavailable desc = service unavailable
Error during extraction: (extracting as transitivedependency/pomxml) failed resolution for src/usr/share/opentelemetry_shell/agent.instrumentation.java/pom.xml: failed resolving {Maven:dummy:dummy[Concrete:0] {}}: rpc error: code = Unavailable desc = service unavailable
Error during extraction: (extracting as transitivedependency/requirements) failed resolution for src/usr/share/opentelemetry_shell/agent.instrumentation.python/instrumentation_roots_requirements.txt: rpc error: code = Unavailable desc = service unavailable
failed resolution for src/opt/opentelemetry_shell/requirements.txt: rpc error: code = Unavailable desc = service unavailable
failed resolution for src/usr/share/opentelemetry_shell/agent.instrumentation.python/requirements.txt: rpc error: code = Unavailable desc = service unavailable

Total 2 packages affected by 2 known vulnerabilities (0 Critical, 2 High, 0 Medium, 0 Low, 0 Unknown) from 1 ecosystem.
2 vulnerabilities can be fixed.

+-------------------------------------+------+-----------+-----------------+---------+---------------+------------------------------------------+
| OSV URL                             | CVSS | ECOSYSTEM | PACKAGE         | VERSION | FIXED VERSION | SOURCE                                   |
+-------------------------------------+------+-----------+-----------------+---------+---------------+------------------------------------------+
| https://osv.dev/GHSA-mh99-v99m-4gvg | 7.5  | npm       | brace-expansion | 1.1.16  | 5.0.8         | actions/instrument/job/package-lock.json |
| https://osv.dev/GHSA-mh99-v99m-4gvg | 7.5  | npm       | brace-expansion | 2.1.2   | 5.0.8         | actions/instrument/job/package-lock.json |
+-------------------------------------+------+-----------+-----------------+---------+---------------+------------------------------------------+


[REPOSITORY_OSV_SCANNER_ERROR_SERVICE_UNAVAILABLE] osv-scanner could not reach the deps.dev / OSV transitive-dependency resolution service (gRPC "service unavailable").
This is a transient remote service issue, not a vulnerability finding.
Workarounds:
  - Retry the run later.
  - Temporarily mark the linter as non-blocking by adding to your .mega-linter.yml:
      DISABLE_ERRORS_LINTERS:
        - REPOSITORY_OSV_SCANNER
❌ REPOSITORY / trivy - 11 errors

No output available

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff

MegaLinter is graciously provided by OX Security
Show us your support by starring ⭐ the repository

Copilot AI changed the title [WIP] Bump idna version to >=3.15 due to known CVE Add explicit idna>=3.15 constraint for SDK wrapper requirements Jul 25, 2026
Copilot AI requested a review from plengauer July 25, 2026 12:54
@plengauer
plengauer marked this pull request as ready for review July 25, 2026 17:42
@plengauer
plengauer requested a review from moflwi as a code owner July 25, 2026 17:42
Copilot AI review requested due to automatic review settings July 25, 2026 17:42
@plengauer
plengauer enabled auto-merge (squash) July 25, 2026 17:42
Copilot AI reviewed Jul 25, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR addresses an osv-scanner-reported Python vulnerability exposure in the SDK wrapper dependency set by explicitly constraining idna to a fixed (non-vulnerable) version range.

Changes:

  • Add an explicit idna>=3.15 requirement to the SDK wrapper Python requirements to prevent resolving vulnerable idna versions.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments
@moflwi moflwi Awaiting requested review from moflwi moflwi is a code owner
+1 more reviewer
@plengauer plengauer plengauer approved these changes
Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

@plengauer plengauer

Copilot code review Copilot

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[MegaLinter][valid][security] idna 3.9.0 has a known CVE — bump to >=3.15

3 participants

@plengauer
Morty Proxy This is a proxified and sanitized view of the page, visit original site.