- [ ] Have you followed the guidelines for contributing? - [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)? - [ ] Have you successfully run `make lint && make test`? - [ ] Have you added an entry to the changelog (`docs/reference/changelog.rst`)? --- ## Description Security scans failing on urllib3 2.5.0 due to GHSA-2xpw-w6gg-jr37 and GHSA-gm62-xv2j-4w53 (both severity 8.9). ## Changes - **uv.lock**: Updated urllib3 from 2.5.0 to 2.6.1 with corresponding package hashes urllib3 2.6.1 resolves both advisories. No application code changes required. The starflow CI workflow automatically generates requirements files from uv.lock during security scans, so no manual requirements file is needed in the repository. <!-- START COPILOT ORIGINAL PROMPT --> <details> <summary>Original prompt</summary> > ## Problem Statement: Security Job Failure > The security scan in the Check policy workflow is failing due to high-severity vulnerabilities in the `urllib3` package (v2.5.0), as seen in the logs: > > | https://osv.dev/GHSA-2xpw-w6gg-jr37 | 8.9 | PyPI | urllib3 | 2.5.0 | requirements/uv-requirements.--all-extras.txt | > > | https://osv.dev/GHSA-gm62-xv2j-4w53 | 8.9 | PyPI | urllib3 | 2.5.0 | requirements/uv-requirements.--all-extras.txt | > This causes `osv-scanner` to fail and the workflow to exit with code 1. > > ## Solution > - Update `urllib3` in `requirements/uv-requirements.--all-extras.txt` to a secure version that resolves these advisories (see: > - https://osv.dev/GHSA-2xpw-w6gg-jr37 > - https://osv.dev/GHSA-gm62-xv2j-4w53) > - Re-run the workflow to verify the scan passes. > > ### Suggested Code Change: > - In `requirements/uv-requirements.--all-extras.txt`, change: > ``` > urllib3==2.5.0 > ``` > to the latest secure version. For example, if 2.5.2 or higher resolves the issue: > ``` > urllib3==2.5.2 > ``` > - Check advisories for the correct patched version. > > --- > References: > - osv-scanner job log: failure due to vulnerabilities in urllib3 > - Job definition: .github/workflows/policy.yaml (ref: 07920c7e1715dcbe1050313093b493ee1acd3863) > </details> <!-- START COPILOT CODING AGENT SUFFIX --> *This pull request was created as a result of the following prompt from Copilot chat.* > ## Problem Statement: Security Job Failure > The security scan in the Check policy workflow is failing due to high-severity vulnerabilities in the `urllib3` package (v2.5.0), as seen in the logs: > > | https://osv.dev/GHSA-2xpw-w6gg-jr37 | 8.9 | PyPI | urllib3 | 2.5.0 | requirements/uv-requirements.--all-extras.txt | > > | https://osv.dev/GHSA-gm62-xv2j-4w53 | 8.9 | PyPI | urllib3 | 2.5.0 | requirements/uv-requirements.--all-extras.txt | > This causes `osv-scanner` to fail and the workflow to exit with code 1. > > ## Solution > - Update `urllib3` in `requirements/uv-requirements.--all-extras.txt` to a secure version that resolves these advisories (see: > - https://osv.dev/GHSA-2xpw-w6gg-jr37 > - https://osv.dev/GHSA-gm62-xv2j-4w53) > - Re-run the workflow to verify the scan passes. > > ### Suggested Code Change: > - In `requirements/uv-requirements.--all-extras.txt`, change: > ``` > urllib3==2.5.0 > ``` > to the latest secure version. For example, if 2.5.2 or higher resolves the issue: > ``` > urllib3==2.5.2 > ``` > - Check advisories for the correct patched version. > > --- > References: > - osv-scanner job log: failure due to vulnerabilities in urllib3 > - Job definition: .github/workflows/policy.yaml (ref: 07920c7e1715dcbe1050313093b493ee1acd3863) > <!-- START COPILOT CODING AGENT TIPS --> --- 💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more [Copilot coding agent tips](https://gh.io/copilot-coding-agent-tips) in the docs.