Repository navigation
deps: keep Python 3.10 on filelock below the ReadWriteLock advisories - #284
Conversation
filelock 4.2.1 fixes GHSA-v4x8-3wr5-3wq8 (high), GHSA-567q-5qvw-pf92 and GHSA-9vhv-jxww-xfm5 (low), but requires Python 3.11, so the Python 3.10 resolution stayed on an affected 3.29-4.0 release. The affected range starts at 3.20.4, so constrain Python 3.10 to filelock<3.20.4 (resolves 3.20.3) in the root project and every tracked example. Python 3.11+ keeps 4.2.4. Nothing in the dependency tree uses filelock's ReadWriteLock, so the advisories were not reachable; this clears them without dropping 3.10. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
![arcjet-review[bot]](https://avatars.githubusercontent.com/u/24397786?s=60&v=4){kind=small}
There was a problem hiding this comment.
Arcjet Review — 🟢 Normal Risk
Decision: Approved
Rationale: The conditional uv constraint excludes filelock 3.20.4 and newer only below Python 3.11, preserving the existing Python support floor without changing application security logic or published dependency requirements. The inspected Flask example lockfile confirms the described 3.20.3/4.2.4 split. No concrete correctness or security defect was found.
Summary of Changes
Adds a Python-version-specific filelock upper bound to the root project and eleven example projects, with comments explaining the advisory-related compatibility workaround.
Escalation Triggers
- Dependency Changes: Twelve pyproject.toml files gain a conditional constraint on the existing transitive filelock dependency.
Review Steps
API Review
| Relevancy | Outcome |
|---|---|
| none | ⏭️ Skipped |
Data Flow Map
| Relevancy | Outcome |
|---|---|
| none | ⏭️ Skipped |
Dependency Audit
| Relevancy | Outcome |
|---|---|
| high | ✅ Pass |
Constrains an existing transitive dependency without adding dependencies or expanding their use.
Docs Review
| Relevancy | Outcome |
|---|---|
| none | ⏭️ Skipped |
Historical ADR Review
| Relevancy | Outcome |
|---|---|
| none | ⏭️ Skipped |
Migration Safety
| Relevancy | Outcome |
|---|---|
| none | ⏭️ Skipped |
Security Review
| Relevancy | Outcome |
|---|---|
| medium | ✅ Pass |
No secrets, new input-handling paths, or security-control changes; no concrete vulnerability introduced by the diff.
Test Coverage
| Relevancy | Outcome |
|---|---|
| medium |
Root CI checks locking and tests Python 3.10–3.14, but does not check the independent example lockfiles.
Zero Data Retention
| Relevancy | Outcome |
|---|---|
| none | ⏭️ Skipped |
WorkOS Audit Logging
| Relevancy | Outcome |
|---|---|
| none | ⏭️ Skipped |
Notes
Static review only; dependency resolution and tests were not executed. The inspected example lockfile supports the stated version split, but advisory ranges and the third-party ReadWriteLock reachability claim were not independently verified. The tool.uv constraints apply to these uv projects, not downstream pip installations of the published SDK.
Path filtering: 12 files excluded by ignore paths. 12 of 24 files included in review.
Review: 1470f159 | Model: openai/gpt-6-astra | Powered by Arcjet Review
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
filelock 4.2.1 fixes GHSA-v4x8-3wr5-3wq8 (high), GHSA-567q-5qvw-pf92 and GHSA-9vhv-jxww-xfm5 (low), but requires Python 3.11, so the Python 3.10 resolution stayed on an affected 3.29-4.0 release. The affected range starts at 3.20.4, so constrain Python 3.10 to filelock<3.20.4 (resolves 3.20.3) in the root project and every tracked example. Python 3.11+ keeps 4.2.4.
Nothing in the dependency tree uses filelock's ReadWriteLock, so the advisories were not reachable; this clears them without dropping 3.10.