fix(deps): vuln httpx2 (minor → 2.13.1) [pyproject.toml] - #312
Merged
dd-prapprover-prod-77c48c[bot] merged 1 commit intoSep 29, 2026
Conversation
|
🔄 Datadog auto-retried 1 job - 1 passed on retry 🎯 Code Coverage (details) 🔗 Commit SHA: 654e093 | Docs | View more details | Give us feedback! |
Co-authored-by: gh-worker-campaigns-3e9aa4[bot] <244854796+gh-worker-campaigns-3e9aa4[bot]@users.noreply.github.com>
Contributor
Author
Auto-rebase completeBranch is up to date with Auto-Rebase · Add |
dd-octo-sts-4aefcb
Bot
force-pushed
the
engraver-auto-version-upgrade/minorpatch/uv/0-1790583225
branch
from
September 29, 2026 12:08
86bf2d3 to
654e093
Compare
|
PRApprover will approve and merge this PR, FAQ, #dx-source-code-management 🛠️ PRApproval Status
➡️ Current phase: PR merged successfully! ✅ |
![dd-prapprover-prod-77c48c[bot]](https://avatars.githubusercontent.com/u/244837012?s=60&v=4){kind=small}
dd-prapprover-prod-77c48c
Bot
deleted the
engraver-auto-version-upgrade/minorpatch/uv/0-1790583225
branch
September 29, 2026 19:14
github-actions Bot
pushed a commit
that referenced
this pull request
Sep 29, 2026
**Summary:** High-severity security update — 1 package upgraded (MINOR changes included) **Manifests changed:** - `pyproject.toml` (uv) --- **✅ Action Required:** Please review the changes below. If they look good, **approve and merge this PR**. --- ## Updates | Package | From | To | Type | Dep Type | Vulnerabilities Fixed | |---------|------|-----|------|----------|----------------------| | httpx2 | 2.9.1 | 2.13.1 | minor | Direct | 7 HIGH, 9 MEDIUM | --- ## Security Details <details open> <summary><strong>🚨 Critical & High Severity (7 fixed)</strong></summary> | Package | CVE | Severity | Summary | Unsafe Version | Fixed In | Case | |---------|-----|----------|---------|----------------|----------|------| | httpx2 | [GHSA-7mj9-2mp8-4m2p](https://osv.dev/GHSA-7mj9-2mp8-4m2p) | HIGH | HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies | 2.9.1 | 2.10.0 | -<!--case:0e7ef708661b--> | | httpx2 | [PYSEC-2026-3846](https://osv.dev/PYSEC-2026-3846) | HIGH | HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification) | 2.9.1 | 2.12.0 | -<!--case:7d2fc789fd53--> | | httpx2 | [CVE-2026-84382](https://osv.dev/CVE-2026-84382) | HIGH | HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification) | 2.9.1 | - | -<!--case:d7e6b9f65c29--> | | httpx2 | [GHSA-8xx6-hgc6-gc2m](https://osv.dev/GHSA-8xx6-hgc6-gc2m) | HIGH | HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification) | 2.9.1 | 2.12.0 | -<!--case:35e582c8f67b--> | | httpx2 | [CVE-2026-84381](https://osv.dev/CVE-2026-84381) | HIGH | HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies | 2.9.1 | - | -<!--case:099bf1f24b76--> | | httpx2 | [PYSEC-2026-3845](https://osv.dev/PYSEC-2026-3845) | HIGH | HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies | 2.9.1 | 2.10.0 | -<!--case:f27bbc44b65e--> | | httpx2 | [PYSEC-2026-3844](https://osv.dev/PYSEC-2026-3844) | HIGH | HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies | 2.9.1 | - | -<!--case:c5bef935f826--> | </details> <details> <summary><strong>ℹ️ Other Vulnerabilities (9)</strong></summary> | Package | CVE | Severity | Summary | Unsafe Version | Fixed In | Case | |---------|-----|----------|---------|----------------|----------|------| | httpx2 | [CVE-2026-84379](https://osv.dev/CVE-2026-84379) | medium | HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers | 2.9.1 | - | -<!--case:153c206ef9b0--> | | httpx2 | [PYSEC-2026-3848](https://osv.dev/PYSEC-2026-3848) | medium | HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers | 2.9.1 | 2.11.0 | -<!--case:1172ee1ac710--> | | httpx2 | [CVE-2026-84378](https://osv.dev/CVE-2026-84378) | MODERATE | HTTPX2: Quadratic SSE line buffering can cause CPU denial of service | 2.9.1 | - | -<!--case:f7c4ce35c531--> | | httpx2 | [PYSEC-2026-3849](https://osv.dev/PYSEC-2026-3849) | MODERATE | HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated | 2.9.1 | 2.11.0 | -<!--case:ca2228985eac--> | | httpx2 | [CVE-2026-84380](https://osv.dev/CVE-2026-84380) | MODERATE | HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated | 2.9.1 | - | -<!--case:7123280ce535--> | | httpx2 | [GHSA-pf96-p4fj-6566](https://osv.dev/GHSA-pf96-p4fj-6566) | MODERATE | HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated | 2.9.1 | 2.11.0 | -<!--case:2ee644fd6c1c--> | | httpx2 | [PYSEC-2026-3847](https://osv.dev/PYSEC-2026-3847) | MODERATE | HTTPX2: Quadratic SSE line buffering can cause CPU denial of service | 2.9.1 | 2.10.0 | -<!--case:891388333df7--> | | httpx2 | [GHSA-f2fp-rgf2-35cp](https://osv.dev/GHSA-f2fp-rgf2-35cp) | MODERATE | HTTPX2: Quadratic SSE line buffering can cause CPU denial of service | 2.9.1 | 2.10.0 | -<!--case:8d3b79ddcde5--> | | httpx2 | [GHSA-h4x7-gw46-3wm6](https://osv.dev/GHSA-h4x7-gw46-3wm6) | MODERATE | HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers | 2.9.1 | 2.11.0 | -<!--case:54dbb7901326--> | </details> --- ## Review Checklist **Standard review:** - [ ] Review changes for compatibility with your code - [ ] Check for breaking changes in release notes - [ ] Run tests locally or wait for CI - [ ] **Approve and merge this PR** --- Update Mode: all_vulns *🤖 Generated by DataDog Automated Dependency Management System* Co-authored-by: dd-octo-sts-4aefcb[bot] <266798660+dd-octo-sts-4aefcb[bot]@users.noreply.github.com> Co-authored-by: gh-worker-campaigns-3e9aa4[bot] <244854796+gh-worker-campaigns-3e9aa4[bot]@users.noreply.github.com> 9fb54f5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary: High-severity security update — 1 package upgraded (MINOR changes included)
Manifests changed:
pyproject.toml(uv)✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.
Updates
Security Details
🚨 Critical & High Severity (7 fixed)
ℹ️ Other Vulnerabilities (9)
Review Checklist
Standard review:
Update Mode: all_vulns
🤖 Generated by DataDog Automated Dependency Management System