[Security] Remediate active vulnerabilities in mlops-python-package (9 alerts) #441

#jules

Security Remediation Required for mlops-python-package

This repository currently has 9 active security alert(s):

• Dependabot alerts: 9
• Code Scanning (SAST) alerts: 0

Key Vulnerability Breakdown

Dependabot Vulnerabilities:

• brotli (CRITICAL) - Fixed in 1.2.1 | Manifests: poetry.lock, requirements.txt
  • GHSA-9v8h-qqgm-4m35: Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package
  • GHSA-9v8h-qqgm-4m35: Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package
• Gitpython (HIGH) - Fixed in 3.2.1 | Manifests: poetry.lock, requirements.txt
  • GHSA-83vg-56qc-22m7: GitPython validates a submodule's ".git" path only after cloning into it (RCE)
  • GHSA-83vg-56qc-22m7: GitPython validates a submodule's ".git" path only after cloning into it (RCE)
• graphql-core (HIGH) - Fixed in 3.2.12 | Manifests: requirements.txt
  • GHSA-r77w-qph3-7vf8: GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit
  • GHSA-vj8h-fx38-h3vc: GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule
• opentelemetry-api (MEDIUM) - Fixed in 1.45.1 | Manifests: poetry.lock, requirements.txt
  • GHSA-xcq7-p3pf-p88h: OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api
  • GHSA-xcq7-p3pf-p88h: OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api
• certifi (CRITICAL) - Fixed in 2026.10.19 | Manifests: requirements.txt
  • GHSA-6q48-6c7w-9gw2: certifi bundles emSign root CAs with compromised intermediate CA keys

Remediation Instructions for @jules

1. Analyze the security alerts and identify the affected manifests, lockfiles, or code paths.
2. Apply surgical updates to dependencies and code to eliminate the vulnerabilities.
3. Run local builds, tests, and linters to verify zero regressions.
4. Submit a Pull Request targeting the default branch referencing this issue.

cc @lgcorzo