scripts,blockifier_test_utils,deployment: regenerate pinned python requirements - #15112
Open
avi-starkware wants to merge 1 commit into
Open
avi-starkware wants to merge 1 commit into
avi-starkware wants to merge 1 commit into
Conversation
avi-starkware
added this pull request to stack #15113
September 10, 2026 13:06
|
This change is |
Dependency ReviewThe following issues were found:
License Issuesscripts/requirements.txt
OpenSSF ScorecardScorecard details
Scanned Files
|
![semgrep-code-starkware-libs[bot]](https://avatars.githubusercontent.com/u/59333826?s=60&v=4){kind=small}
| charset-normalizer==3.5.1 | ||
| ckzg==2.1.8 | ||
| cytoolz==1.1.0 | ||
| ecdsa==0.19.2 |
There was a problem hiding this comment.
High severity vulnerability may affect your project—review required:
Line 14 lists a dependency (ecdsa) with a known High severity vulnerability.
ℹ️ Why this matters
Affected versions of ecdsa are vulnerable to Minerva timing attack (side-channel) when using the NIST P-256 curve. Using the ecdsa.SigningKey.sign_digest() function and timing signatures an attacker can leak the internal nonce which may allow for private key discovery. The library considers side-channel attacks out of scope and there will be no fix.
References: https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-0448, GHSA, CVE
To resolve this comment:
Check if you expose the library in a way that allows an attacker to measure how long it takes to generate a key pair or sign a message through a side-channel. Examples include but are not limited to an attacker being able to run code on the same physical machine in which key pair generation or signing is taking place (this includes virtual machines), an attacker being able to measure how much power your computer uses during key pair generation or signing, and an attacker being able to measure RF interference coming from your computer during key pair generation or signing..
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
Collaborator
Author
There was a problem hiding this comment.
/ar Pre-existing and unfixable upstream: ecdsa is a transitive dependency of cairo-lang (the Cairo 0 compiler used only to build test contracts in CI); nothing here signs with P-256 in a context where an attacker can time it, and the maintainers state side-channel attacks are out of scope with no fix planned (CVE-2024-23342). This PR moves ecdsa 0.19.1 → 0.19.2, which is the latest release.
avi-starkware
force-pushed
the
avi/deps/02-pip-regen
branch
from
September 14, 2026 09:52
d787854 to
1d17a45
Compare
avi-starkware
removed this pull request from stack #15113
September 14, 2026 09:54
avi-starkware
added this pull request to stack #15116
September 14, 2026 09:55
avi-starkware
force-pushed
the
avi/deps/02-pip-regen
branch
from
September 14, 2026 10:16
1d17a45 to
46b489f
Compare
…quirements Both frozen requirement files are pip freeze regenerations produced by the procedure documented in their -gen.txt headers, with the cairo-lang, black and pydantic compiler/tool pins unchanged. Bump the monitoring requests pin to 2.33.0 and relock Pipfile.lock under python 3.10. Pin pydantic in blockifier-test-utils-requirements-gen.txt, mirroring the existing pin in scripts/requirements-gen.txt so pypy3.9 in CI still has pydantic_core wheels. Cap bitarray at 3.9.0 in both -gen.txt files; 3.9.2 and above build a module that fails to import on pypy3.9 with undefined symbol Py_RETURN_RICHCOMPARE. Unchanged on purpose: the black 23.1a1 pin, and ecdsa, which has no patched release and is pulled in by cairo-lang. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
avi-starkware
force-pushed
the
avi/deps/02-pip-regen
branch
from
September 14, 2026 10:38
46b489f to
1c0d348
Compare
avi-starkware
marked this pull request as ready for review
September 14, 2026 11:16
PR SummaryLow Risk Overview Adds PyPy 3.9–safe constraints to both Separately bumps Reviewed by Cursor Bugbot for commit 1c0d348. Bugbot is set up for automated code reviews on this repo. Configure here. |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
pip freezeregeneration of both frozen requirement files via the procedure in their-gen.txtheaders, plus the monitoringrequestsbump andPipfile.lockrelock under Python 3.10. Compiler/tool pins unchanged:cairo-lang==0.14.3a3(scripts),cairo-lang==0.14.0.1(blockifier test utils),black==23.1a1.Two constraints added to the
-gen.txtfiles, both forced by CI running PyPy 3.9:scripts/requirements-gen.txtalready does (newerpydantic_corehas no pp39 wheel and needs Python ≥3.11 to build).bitarray<=3.9.0in both: 3.9.2+ installs but fails at import on PyPy 3.9 (undefined symbol: Py_RETURN_RICHCOMPARE), which would breakstarknet-compile-deprecatedandfeature_contracts_compatibility_test.Verified: fresh-venv installs of both files on CPython 3.9 and PyPy 3.9,
cairo-compileruns, real repo contracts compile under the PyPy venv.Still open after this PR:
aiohttp/pytest/requests/urllib3fixes all require Python ≥3.10;ecdsahas no patched release;blackis behind the deliberate 23.1a1 pin.🤖 Generated with Claude Code