Bump idna from 3.10 to 3.15 in /python/samples/demos/mcp_with_oauth - #14186
Bump idna from 3.10 to 3.15 in /python/samples/demos/mcp_with_oauth#14186dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [idna](https://github.com/kjd/idna) from 3.10 to 3.15. - [Release notes](https://github.com/kjd/idna/releases) - [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md) - [Commits](kjd/idna@v3.10...v3.15) --- updated-dependencies: - dependency-name: idna dependency-version: '3.15' dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Automated Code Review
Reviewers: 5 | Confidence: 86%
✓ Correctness
This is a straightforward Dependabot security update bumping idna from 3.10 to 3.15 in a uv.lock file. The update addresses CVE-2026-45409 (quadratic-time bypass). The lock file changes are auto-generated by uv's resolver: the idna version, hashes, and URLs are updated, and the exceptiongroup typing-extensions marker shifted from <3.12 to <3.11 as a normal side effect of re-resolution. No correctness issues found.
✓ Security Reliability
This is a straightforward Dependabot security bump of the
idnapackage from 3.10 to 3.15 in theuv.lockfile for themcp_with_oauthsample. The update addresses CVE-2026-45409, which fixes a bypass of the CVE-2024-3651 mitigation for quadratic-time processing of oversized inputs. The lock file changes are auto-generated byuv, include proper SHA256 hashes for integrity verification, and theexceptiongroupmarker adjustment is a normal side-effect of lock resolution. No security or reliability concerns.
✓ Test Coverage
This is a Dependabot PR that bumps the
idnadependency from 3.10 to 3.15 in the uv.lock file of a sample/demo project (python/samples/demos/mcp_with_oauth). The change is confined entirely to a lockfile — no source code or test code is modified. There are no new behaviors, APIs, or logic changes that would require test coverage. No test coverage concerns apply.
✓ Failure Modes
This PR is a straightforward Dependabot security bump of idna from 3.10 to 3.15 in the uv.lock file for a sample/demo project. The update addresses CVE-2026-45409 (quadratic-time processing bypass). The only changes are version, hash, and URL updates for the idna package, plus a minor marker adjustment for exceptiongroup's typing-extensions dependency (a normal side effect of lock file re-resolution). No source code is modified, no new failure modes are introduced.
✗ Design Approach
The dependency bump is incomplete for this demo: the top-level client lockfile now uses
idna 3.15, but the same sample’s documented server flow still resolves frompython/samples/demos/mcp_with_oauth/server/uv.lock, which remains pinned toidna 3.10. Because the README directs users to run both the authorization server and resource server from that subproject, this change does not fully address the security update for the sample as a whole.
Flagged Issues
-
python/samples/demos/mcp_with_oauth/README.md:16-19and:34-40instruct users to run the sample frompython/samples/demos/mcp_with_oauth/server, butpython/samples/demos/mcp_with_oauth/server/uv.lock:127-132still pinsidnato3.10. Updating only the parentuv.lockleaves the documented server code path on the old version, so the PR does not fully solve the dependency bump it is trying to make.
Automated review by dependabot[bot]'s agents
| [[package]] | ||
| name = "idna" | ||
| version = "3.10" | ||
| version = "3.15" |
There was a problem hiding this comment.
This only updates the client-side lockfile. The demo's README still tells users to cd samples/demos/mcp_with_oauth/server and run both servers there (README.md:16-19, :34-40), and that subproject's separate lockfile still pins idna 3.10 (server/uv.lock:127-132). As written, the documented server path for this sample remains on the old version, so the security bump is incomplete.
|
Flagged issue
Source: automated DevFlow PR review |
### Motivation and Context Consolidates the currently open Python and .NET Dependabot updates into one coordinated dependency change. This reduces duplicate review and CI work while preserving each source PR's update intent. The npm and Yarn updates are intentionally excluded from this draft and remain in their original Dependabot PRs. ### Related Issue Supersedes: - microsoft#14178 - microsoft#14184 - microsoft#14185 - microsoft#14186 - microsoft#14187 - microsoft#14188 - microsoft#14189 - microsoft#14191 - microsoft#14192 - microsoft#14202 - microsoft#14203 - microsoft#14204 - microsoft#14205 - microsoft#14207 - microsoft#14208 - microsoft#14211 - microsoft#14212 - microsoft#14213 - microsoft#14214 - microsoft#14215 - microsoft#14216 - microsoft#14217 - microsoft#14218 - microsoft#14219 - microsoft#14221 ### Description - Updates the selected .NET Aspire and AWS SDK package versions in central package management. - Updates the selected Python requirements and regenerates both affected uv lockfiles without losing earlier bumps. - Keeps the compatible ONNX Runtime/GenAI pair on Python 3.10 while applying ONNX Runtime GenAI 0.14.1 on Python 3.11 and newer. - Retains pyOpenSSL 26.2.0, which is newer than the 26.0.0 requested by its source PR and is required by the consolidated cryptography update. - Uses Pinecone 7.3 or newer on Windows, where Pinecone 7.0.1 imports the unavailable Unix `readline` module, while retaining the existing `~=7.0` range on macOS and Linux. - Constrains MCP to the compatible 1.x API because the current Semantic Kernel integration imports interfaces removed by MCP 2.0. ### Validation - Python unit tests passed across Python 3.10-3.13 on Ubuntu, Windows, and macOS, including Dapr jobs. - Python pre-commit, lock validation, spell checking, and integration-test aggregate checks passed. - .NET 9/10 builds, package-install checks, unit tests, AOT tests, formatting, and coverage checks passed on Ubuntu and Windows. - Merge Gatekeeper passed. ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [x] All unit tests pass, and I have added new tests where possible - [x] I didn't break anyone 😄
|
Superseded by #14222 |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
Bumps idna from 3.10 to 3.15.
Changelog
Sourced from idna's changelog.
... (truncated)
Commits
af30a09Release 3.1530314d4Pre-release 3.15rc005d4b21Merge pull request #237 from kjd/convert-docs-to-markdown2987fdbConvert README and HISTORY from reStructuredText to Markdown59fa800Merge pull request #236 from kjd/dependabot/github_actions/actions-f3e34333eadef6983Merge branch 'master' into dependabot/github_actions/actions-f3e34333eabbd8004Merge pull request #234 from StanFromIreland/patch-1edd07c0Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions group5557db0Merge branch 'master' into patch-1f11746cMerge pull request #235 from StanFromIreland/patch-2Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.