mirror of
https://github.com/ComposioHQ/composio.git
synced 2026-09-22 11:46:35 +08:00
Alberto Schiabel
1049942edb
This PR: - raises the `composio` package floors to `requests>=2.32.4` and `urllib3>=2.7.0` in `python/pyproject.toml`, `python/setup.py`, and `uv.lock` - closes GHSA-9hjg-9r4m-mvj7 (`requests` `.netrc` credential leak via malicious URLs) for downstream installs; `url_safety` fetches user- and server-supplied URLs through a `trust_env` session - closes GHSA-mf9v-mfxr-j63j (decompression-bomb guard bypass in the `urllib3` streaming API that `_fetch_file_from_url` relies on for its size limit) and GHSA-qccp-gfcp-xxvc (sensitive headers forwarded across origins) - the workspace lock already resolves 2.34.2 / 2.7.0, so only the `requires-dist` specifiers change; `uv lock --check` passes and `import composio` still works - documents the advisory IDs next to each floor so the next bump has context
54 lines
1.8 KiB
TOML
54 lines
1.8 KiB
TOML
[project]
|
|
name = "composio"
|
|
version = "0.21.1"
|
|
description = "SDK for integrating Composio with your applications."
|
|
readme = "README.md"
|
|
requires-python = ">=3.10,<4"
|
|
dependencies = [
|
|
"pysher>=1.0.8",
|
|
"pydantic>=2.11.9",
|
|
"composio-client==1.43.0",
|
|
"typing-extensions>=4.16.0",
|
|
"openai>=2.48.0",
|
|
"json-schema-to-pydantic>=0.4.11",
|
|
"jsonschema>=4.23.0",
|
|
# The pinning adapter mounts through `get_connection_with_tls_context`,
|
|
# which `HTTPAdapter.send` only calls on requests >= 2.32.2; older
|
|
# versions silently skip it and the pinning never engages.
|
|
# 2.32.4 fixes GHSA-9hjg-9r4m-mvj7 (.netrc credentials leaked to a
|
|
# malicious URL); `url_safety` fetches user- and server-supplied URLs.
|
|
"requests>=2.32.4",
|
|
# `url_safety` imports urllib3 directly: `NameResolutionError` only exists
|
|
# from 2.0, and the pinning adapter reaches into 2.x connection internals.
|
|
# requests alone allows 1.x, which would fail at import time.
|
|
# 2.7.0 fixes GHSA-mf9v-mfxr-j63j (decompression-bomb guard bypass in
|
|
# the streaming API our download size limit relies on) and
|
|
# GHSA-qccp-gfcp-xxvc (sensitive headers forwarded across origins).
|
|
"urllib3>=2.7.0",
|
|
]
|
|
classifiers = [
|
|
"Programming Language :: Python :: 3",
|
|
"License :: OSI Approved :: Apache Software License",
|
|
"Operating System :: OS Independent",
|
|
]
|
|
|
|
[dependency-groups]
|
|
dev = [
|
|
"composio",
|
|
"nox>=2026.7.11",
|
|
"pytest>=9.1.1",
|
|
"pytest-timeout>=2.4.0",
|
|
"pytest-mock>=3.15.1",
|
|
"hypothesis>=6.140.3",
|
|
"requests>=2.34.2",
|
|
"ruff>=0.16.0",
|
|
# Langchain provider demo
|
|
"langchain_openai==1.6.0",
|
|
"fastapi>=0.140.0",
|
|
"twine>=6.2.0",
|
|
"click>=8.4.2",
|
|
"semver>=3.0.4",
|
|
# CrewAI 1.x currently constrains Tomli to the 2.0 line.
|
|
"tomli>=2.0.2,<2.1",
|
|
]
|