mirror of
https://github.com/ComposioHQ/composio.git
synced 2026-09-22 11:46:35 +08:00
Alberto Schiabel
1049942edb
This PR: - raises the `composio` package floors to `requests>=2.32.4` and `urllib3>=2.7.0` in `python/pyproject.toml`, `python/setup.py`, and `uv.lock` - closes GHSA-9hjg-9r4m-mvj7 (`requests` `.netrc` credential leak via malicious URLs) for downstream installs; `url_safety` fetches user- and server-supplied URLs through a `trust_env` session - closes GHSA-mf9v-mfxr-j63j (decompression-bomb guard bypass in the `urllib3` streaming API that `_fetch_file_from_url` relies on for its size limit) and GHSA-qccp-gfcp-xxvc (sensitive headers forwarded across origins) - the workspace lock already resolves 2.34.2 / 2.7.0, so only the `requires-dist` specifiers change; `uv lock --check` passes and `import composio` still works - documents the advisory IDs next to each floor so the next bump has context
44 lines
1.5 KiB
Python
44 lines
1.5 KiB
Python
"""
|
|
Setup configuration for compsio core.
|
|
"""
|
|
|
|
from pathlib import Path
|
|
|
|
from setuptools import find_packages, setup
|
|
|
|
|
|
setup(
|
|
name="composio",
|
|
author="Composio",
|
|
author_email="tech@composio.dev",
|
|
description="Core package to act as a bridge between composio platform and other services.",
|
|
long_description=(Path(__file__).parent / "README.md").read_text(encoding="utf-8"),
|
|
long_description_content_type="text/markdown",
|
|
url="https://github.com/composiohq/composio",
|
|
classifiers=[
|
|
"Programming Language :: Python :: 3",
|
|
"License :: OSI Approved :: Apache Software License",
|
|
"Operating System :: OS Independent",
|
|
],
|
|
python_requires=">=3.10,<4",
|
|
packages=find_packages(include=["composio*"]),
|
|
install_requires=[
|
|
"pysher>=1.0.8",
|
|
"pydantic>=2.11.9",
|
|
"composio-client==1.43.0",
|
|
"typing-extensions>=4.16.0",
|
|
"openai>=2.48.0",
|
|
"json-schema-to-pydantic>=0.4.11",
|
|
"jsonschema>=4.23.0",
|
|
# `get_connection_with_tls_context` (the pinning adapter's mount
|
|
# point) is only called by `HTTPAdapter.send` on requests >= 2.32.2.
|
|
# 2.32.4 fixes GHSA-9hjg-9r4m-mvj7 (.netrc credentials leak).
|
|
"requests>=2.32.4",
|
|
# `url_safety` imports urllib3 directly and needs 2.x: 1.x has no
|
|
# `NameResolutionError` and different connection internals.
|
|
# 2.7.0 fixes GHSA-mf9v-mfxr-j63j and GHSA-qccp-gfcp-xxvc.
|
|
"urllib3>=2.7.0",
|
|
],
|
|
include_package_data=True,
|
|
)
|