[Security] Remediate Dependabot vulnerabilities in mlops-python-package (9 alerts) #439

#jules

Active Security Vulnerabilities in mlops-python-package

This repository currently has 9 active Dependabot alert(s) across 5 package(s).

Vulnerable Dependencies Breakdown

📦 Package: brotli

• Highest Severity: CRITICAL
• Manifests / Lockfiles: requirements.txt, poetry.lock
• Recommended Fix: Upgrade brotli to at least 1.2.1
• Security Advisories:
  • GHSA-9v8h-qqgm-4m35 - CRITICAL: Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package (CVE: N/A)
  • GHSA-9v8h-qqgm-4m35 - CRITICAL: Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package (CVE: N/A)

📦 Package: Gitpython

• Highest Severity: HIGH
• Manifests / Lockfiles: requirements.txt, poetry.lock
• Recommended Fix: Upgrade Gitpython to at least 3.2.1
• Security Advisories:
  • GHSA-83vg-56qc-22m7 - HIGH: GitPython validates a submodule's ".git" path only after cloning into it (RCE) (CVE: CVE-2026-114145)
  • GHSA-83vg-56qc-22m7 - HIGH: GitPython validates a submodule's ".git" path only after cloning into it (RCE) (CVE: CVE-2026-114145)

📦 Package: graphql-core

• Highest Severity: HIGH
• Manifests / Lockfiles: requirements.txt
• Recommended Fix: Upgrade graphql-core to at least 3.2.12
• Security Advisories:
  • GHSA-r77w-qph3-7vf8 - HIGH: GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit (CVE: CVE-2026-75508)
  • GHSA-vj8h-fx38-h3vc - HIGH: GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule (CVE: CVE-2026-75507)

📦 Package: opentelemetry-api

• Highest Severity: MEDIUM
• Manifests / Lockfiles: requirements.txt, poetry.lock
• Recommended Fix: Upgrade opentelemetry-api to at least 1.45.1
• Security Advisories:
  • GHSA-xcq7-p3pf-p88h - MEDIUM: OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api (CVE: CVE-2026-114603)
  • GHSA-xcq7-p3pf-p88h - MEDIUM: OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api (CVE: CVE-2026-114603)

📦 Package: certifi

• Highest Severity: CRITICAL
• Manifests / Lockfiles: requirements.txt
• Recommended Fix: Upgrade certifi to at least 2026.10.19
• Security Advisories:
  • GHSA-6q48-6c7w-9gw2 - CRITICAL: certifi bundles emSign root CAs with compromised intermediate CA keys (CVE: N/A)

Remediation Steps

1. Update the dependency specifications and regenerate project lockfiles to include the fixed versions.
2. Ensure all project tests, linters, and build checks pass cleanly.
3. Submit a Pull Request targeting the default branch referencing this issue so GitHub auto-closes the Dependabot alerts upon merge.

cc @lgcorzo