fix: Bump ujson minimum version to 5.10.0#787
Conversation
rithikanarayan
left a comment
rithikanarayan
left a comment
There was a problem hiding this comment.
approved too quickly, I think we should use 5.12.0 or greater per GHSA-wgvc-ghv9-3pmm
| ] | ||
| ujson = ">=5.9.0" | ||
| ujson = [ | ||
| {version = ">=5.10.0,<5.12.0", python = ">=3.8,<3.10"}, |
There was a problem hiding this comment.
Seems like this is the best we can do for Python 3.8 and 3.9 given that v5.12.0 of the ujson library removed support for Python 3.9
There was a problem hiding this comment.
Left this comment to remind us why this is structured this way. Shouldn't be a big deal especially since we are removing support for 3.8 and 3.9 in two months.
There was a problem hiding this comment.
This is the best we can do because security fixes cannot always guarantee coverage for the older versions.
2 participants
Fixes #786
Changes
pyproject.toml — Split the ujson constraint by Python version:
poetry.lock — Updated the ujson entry to include:
This fixes CVE-2026-32874 (memory leak parsing large integers, CVSS 7.5) and CVE-2026-32875 (integer
overflow in indent handling, CVSS 7.5).