Skip to content

Advance mitmproxy pin to unblock security dependency sync - #8840

Closed
ibrahim halatci (ihalatci) wants to merge 1 commit into
mainfrom
ihalatci-security-dependency-pins
Closed

Advance mitmproxy pin to unblock security dependency sync#8840
ibrahim halatci (ihalatci) wants to merge 1 commit into
mainfrom
ihalatci-security-dependency-pins

Conversation

@ihalatci

Copy link
Copy Markdown
Contributor

Summary

Advance the Citus mitmproxy fork pin to the commit from citusdata/mitmproxy#5 in both regression-test Pipfiles and their lock metadata.

The updated fork adds cap support for:

  • cryptography==50.0.0
  • h2==4.4.1
  • tornado==6.5.8
  • OpenSSL 4 unsupported-protocol probe compatibility

This is intentionally a metadata-only minimal change: current package versions remain pinned. Once this PR merges, run dependency-security-sync in citusdata/the-process to generate the actual patched Citus lockfiles and test-image requirements as coordinated PRs.

Validation

The current .github/scripts/security_sync.py from citusdata/the-process was run against all 14 current Citus Dependabot alerts in WSL Ubuntu 22.04 with Python 3.12, resolving the unpublished fork commit locally through a temporary Git URL rewrite.

  • tornado, h2, and cryptography all reported ['applied', 'applied']
  • All alerts were addressed with blocked=[]
  • Paired generated lockfiles were identical
  • pipenv verify succeeded
  • Full generated consumer development dependencies installed; pip check succeeded
  • mitmdump --version started successfully with OpenSSL 4.0.1
  • The fork's targeted seven-file suite passed with baseline and exact patched dependencies: 199 passed and 1 platform skip in each run

No workflow code, package versions, tests, or build tools are changed here.

Consume the fork revision permitting patched cryptography, h2, and tornado versions, including OpenSSL 4 protocol-probe compatibility. Preserve existing resolved versions so the security-sync workflow generates the coordinated dependency and image updates.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@codecov

codecov Bot commented Sep 10, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.73%. Comparing base (5eaf894) to head (e4a61f6).

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #8840      +/-   ##
==========================================
- Coverage   88.73%   88.73%   -0.01%     
==========================================
  Files         289      289              
  Lines       65012    65012              
  Branches     8203     8204       +1     
==========================================
- Hits        57690    57688       -2     
- Misses       4952     4954       +2     
  Partials     2370     2370              
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@ihalatci

Copy link
Copy Markdown
Contributor Author

Superseded by #8841, which includes this mitmproxy pin change together with the generated security dependency updates. The coordinated image requirements are in citusdata/the-process#249; that PR should merge first so its post-merge workflow advances the Citus PR to released images. Closing only this duplicate pin-only PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants