Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions appengine/flexible/analytics/requirements.txt
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
Flask==3.0.3; python_version > '3.6'
Flask==2.3.3; python_version < '3.7'
Werkzeug==3.0.3; python_version > '3.6'
Werkzeug==2.3.8; python_version < '3.7'
Werkzeug==3.1.4; python_version > '3.6'
Werkzeug==3.1.4; python_version < '3.7'
Comment on lines +3 to +4
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

Updating Werkzeug to 3.1.4 is problematic as this version requires Python 3.9+. The previous configuration supported older Python versions, and this change would break compatibility for environments using Python < 3.9.

To address the security vulnerability (GHSA-hgf8-39gv-g3f2) while maintaining broader Python version support, I recommend using different versions of Werkzeug depending on the Python version. The vulnerability is patched in version 3.0.4, which supports Python 3.8+.

For Python 3.7, Werkzeug 2.3.8 was used. The security advisory does not list a patch for the 2.3.x series, which implies it might be vulnerable and unpatched. You should consider dropping support for Python 3.7 for this sample if security is a high priority, or accept the risk.

A better approach would be to use version-specific dependencies that are secure and compatible.

Werkzeug==3.0.4; python_version >= '3.8'
Werkzeug==2.3.8; python_version == '3.7'

gunicorn==23.0.0
requests[security]==2.31.0
4 changes: 2 additions & 2 deletions appengine/flexible/hello_world/requirements.txt
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
Flask==3.0.3; python_version > '3.6'
Flask==2.3.3; python_version < '3.7'
Werkzeug==3.0.3; python_version > '3.6'
Werkzeug==2.3.8; python_version < '3.7'
Werkzeug==3.1.4; python_version > '3.6'
Werkzeug==3.1.4; python_version < '3.7'
gunicorn==23.0.0
4 changes: 2 additions & 2 deletions appengine/flexible/twilio/requirements.txt
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
Flask==3.0.3; python_version > '3.6'
Flask==2.3.3; python_version < '3.7'
Werkzeug==3.0.3; python_version > '3.6'
Werkzeug==2.3.8; python_version < '3.7'
Werkzeug==3.1.4; python_version > '3.6'
Werkzeug==3.1.4; python_version < '3.7'
gunicorn==23.0.0
twilio==9.0.3
2 changes: 1 addition & 1 deletion appengine/flexible/websockets/requirements.txt
Original file line number Diff line number Diff line change
Expand Up @@ -3,4 +3,4 @@ Flask-Sockets==0.2.1
gunicorn==23.0.0
requests==2.31.0
markupsafe==2.0.1
Werkzeug==1.0.1;
Werkzeug==3.1.4;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

This update to Werkzeug==3.1.4 is incompatible with Flask==1.1.4 used in this project. Flask==1.1.4 requires Werkzeug<2.0. This change will break the application.

To address the security vulnerability, both Flask and Werkzeug would need to be updated. However, as the comment on line 1 notes, Flask-Sockets may have compatibility issues with newer versions of Flask. This dependency conflict needs to be resolved carefully. A simple version bump of Werkzeug is not a valid solution here.

Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,4 @@ Flask==3.0.3; python_version > '3.6'
Flask==2.3.3; python_version < '3.7'
gunicorn==23.0.0
requests[security]==2.31.0
Werkzeug==3.0.3
Werkzeug==3.1.4
Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,4 @@ Flask==3.0.3; python_version > '3.6'
Flask==2.3.3; python_version < '3.7'
google-cloud-datastore==2.20.2
gunicorn==23.0.0
Werkzeug==3.0.3
Werkzeug==3.1.4
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
Flask==3.0.3; python_version > '3.6'
Flask==3.0.3; python_version < '3.7'
gunicorn==23.0.0
Werkzeug==3.0.3
Werkzeug==3.1.4
Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,4 @@ Flask==3.0.3; python_version > '3.6'
Flask==2.3.3; python_version < '3.7'
gunicorn==23.0.0
requests[security]==2.31.0
Werkzeug==3.0.3
Werkzeug==3.1.4
Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,4 @@ Flask==3.0.3; python_version > '3.6'
Flask==2.3.3; python_version < '3.7'
gunicorn==23.0.0
requests==2.31.0
Werkzeug==3.0.3
Werkzeug==3.1.4
Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,4 @@ Flask==3.0.3; python_version > '3.6'
Flask==2.3.3; python_version < '3.7'
gunicorn==23.0.0
requests==2.31.0
Werkzeug==3.0.3
Werkzeug==3.1.4
Original file line number Diff line number Diff line change
Expand Up @@ -5,4 +5,4 @@ numpy==2.2.4; python_version > '3.9'
numpy==2.2.4; python_version == '3.9'
numpy==2.2.4; python_version == '3.8'
numpy==2.2.4; python_version == '3.7'
Werkzeug==3.0.3
Werkzeug==3.1.4
Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,4 @@ Flask==3.0.3; python_version > '3.6'
Flask==2.3.3; python_version < '3.7'
google-cloud-pubsub==2.28.0
gunicorn==23.0.0
Werkzeug==3.0.3
Werkzeug==3.1.4
Original file line number Diff line number Diff line change
Expand Up @@ -8,4 +8,4 @@ numpy==2.2.4; python_version == '3.8'
numpy==2.2.4; python_version == '3.7'
pillow==10.4.0
scipy==1.14.1
Werkzeug==3.0.3
Werkzeug==3.1.4
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
Flask==3.0.3; python_version > '3.6'
Flask==2.0.3; python_version < '3.7'
gunicorn==23.0.0
Werkzeug==3.0.3
Werkzeug==3.1.4
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
Flask==3.0.3; python_version > '3.6'
Flask==2.0.3; python_version < '3.7'
werkzeug==3.0.3; python_version > '3.7'
werkzeug==2.3.8; python_version <= '3.7'
werkzeug==3.1.4; python_version > '3.7'
werkzeug==3.1.4; python_version <= '3.7'
Comment on lines +3 to +4
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

Updating werkzeug to 3.1.4 across all Python versions is incorrect. Werkzeug 3.1.4 requires Python 3.9+, so this change will break the application for Python 3.7 and 3.8.

To fix the security vulnerability (GHSA-hgf8-39gv-g3f2) correctly, you should use patched versions that are compatible with the respective Python versions. The vulnerability is patched in 3.0.4 (for Python 3.8+).

For Python 3.7, werkzeug 2.3.8 is likely vulnerable and unpatched. You should consider the security implications of continuing to support Python 3.7 with this package.

werkzeug==3.0.4; python_version > '3.7'
werkzeug==2.3.8; python_version <= '3.7'

google-cloud-storage==2.9.0
gunicorn==23.0.0
Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,4 @@ Flask==3.0.3; python_version > '3.6'
Flask==2.0.3; python_version < '3.7'
gunicorn==23.0.0
google-cloud-tasks==2.18.0
Werkzeug==3.0.3
Werkzeug==3.1.4
Original file line number Diff line number Diff line change
Expand Up @@ -2,5 +2,5 @@ Flask==3.0.3; python_version > '3.6'
Flask==2.0.3; python_version < '3.7'
gunicorn==23.0.0
twilio==9.0.3
Werkzeug==3.0.3; python_version >= '3.7'
Werkzeug==2.3.8; python_version < '3.7'
Werkzeug==3.1.4; python_version >= '3.7'
Werkzeug==3.1.4; python_version < '3.7'
Comment on lines +5 to +6
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

Updating Werkzeug to 3.1.4 is problematic as this version requires Python 3.9+. The previous configuration, although having some inconsistencies in Python version markers, aimed to support older Python versions. This change will break the setup for Python versions < 3.9.

To correctly address the security vulnerability (GHSA-hgf8-39gv-g3f2), you should use patched versions compatible with each Python version. The vulnerability is patched in version 3.0.4 (for Python 3.8+).

The existing markers seem inconsistent with package requirements. A corrected and secure setup would be as suggested.

Werkzeug==3.0.4; python_version >= '3.8'
Werkzeug==2.3.8; python_version == '3.7'

Original file line number Diff line number Diff line change
Expand Up @@ -3,4 +3,4 @@ Flask-Sockets==0.2.1
gunicorn==23.0.0
requests==2.31.0
markupsafe==2.0.1
Werkzeug==1.0.1;
Werkzeug==3.1.4;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

This update to Werkzeug==3.1.4 is incompatible with Flask==1.1.4 used in this project. Flask==1.1.4 requires Werkzeug<2.0. This change will break the application.

To address the security vulnerability, both Flask and Werkzeug would need to be updated. However, as the comment on line 1 notes, Flask-Sockets may have compatibility issues with newer versions of Flask. This dependency conflict needs to be resolved carefully. A simple version bump of Werkzeug is not a valid solution here.

2 changes: 1 addition & 1 deletion bigquery/remote-function/document/requirements.txt
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
Flask==2.2.2
functions-framework==3.9.2
google-cloud-documentai==3.0.1
Werkzeug==2.3.8
Werkzeug==3.1.4
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

Updating Werkzeug to 3.1.4 drops support for Python 3.7 and 3.8, as Werkzeug 3.1.4 requires Python 3.9+. This is a significant breaking change.

To fix the security vulnerability (GHSA-hgf8-39gv-g3f2) while maintaining support for Python 3.8, you should update to Werkzeug==3.0.4. This version is patched and compatible with Python 3.8+.

Note that Werkzeug 2.3.8 (used for Python 3.7) is likely vulnerable and does not have a security patch. You may need to consider dropping support for Python 3.7 to be fully secure.

Werkzeug==3.0.4

2 changes: 1 addition & 1 deletion bigquery/remote-function/translate/requirements.txt
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
Flask==2.2.2
functions-framework==3.9.2
google-cloud-translate==3.18.0
Werkzeug==2.3.8
Werkzeug==3.1.4
2 changes: 1 addition & 1 deletion bigquery/remote-function/vision/requirements.txt
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
Flask==2.2.2
functions-framework==3.9.2
google-cloud-vision==3.8.1
Werkzeug==2.3.8
Werkzeug==3.1.4
2 changes: 1 addition & 1 deletion cloud-sql/mysql/sqlalchemy/requirements.txt
Original file line number Diff line number Diff line change
Expand Up @@ -4,4 +4,4 @@ PyMySQL==1.1.1
gunicorn==23.0.0
cloud-sql-python-connector==1.18.4
functions-framework==3.9.2
Werkzeug==2.3.8
Werkzeug==3.1.4
2 changes: 1 addition & 1 deletion cloud-sql/postgres/sqlalchemy/requirements.txt
Original file line number Diff line number Diff line change
Expand Up @@ -4,4 +4,4 @@ SQLAlchemy==2.0.40
cloud-sql-python-connector==1.18.4
gunicorn==23.0.0
functions-framework==3.9.2
Werkzeug==2.3.8
Werkzeug==3.1.4
2 changes: 1 addition & 1 deletion cloud-sql/sql-server/sqlalchemy/requirements.txt
Original file line number Diff line number Diff line change
Expand Up @@ -6,4 +6,4 @@ SQLAlchemy==2.0.40
cloud-sql-python-connector==1.18.4
sqlalchemy-pytds==1.0.2
functions-framework==3.9.2
Werkzeug==2.3.8
Werkzeug==3.1.4
2 changes: 1 addition & 1 deletion compute/managed-instances/demo/requirements.txt
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
Flask==3.0.3
requests==2.31.0
Werkzeug==3.0.3
Werkzeug==3.1.4
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

Updating Werkzeug from 3.0.3 to 3.1.4 drops support for Python 3.8, as Werkzeug 3.1.4 requires Python 3.9+. This might be an unintended breaking change.

To fix the security vulnerability (GHSA-hgf8-39gv-g3f2) while retaining Python 3.8 support, you should update to Werkzeug==3.0.4. This version contains the security patch and is compatible with Python 3.8.

Werkzeug==3.0.4

2 changes: 1 addition & 1 deletion functions/v2/response_streaming/requirements.txt
Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,4 @@ Flask==2.2.2
functions-framework==3.9.2
google-cloud-bigquery==3.27.0
pytest==8.2.0
Werkzeug==2.3.8
Werkzeug==3.1.4
2 changes: 1 addition & 1 deletion iap/app_engine_app/requirements.txt
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
Flask==3.0.3
Werkzeug==3.0.3
Werkzeug==3.1.4
2 changes: 1 addition & 1 deletion memorystore/redis/requirements.txt
Original file line number Diff line number Diff line change
Expand Up @@ -14,5 +14,5 @@
Flask==3.0.3
gunicorn==23.0.0
redis==6.0.0
Werkzeug==3.0.3
Werkzeug==3.1.4
# [END memorystore_requirements]
2 changes: 1 addition & 1 deletion monitoring/opencensus/requirements.txt
Original file line number Diff line number Diff line change
Expand Up @@ -8,4 +8,4 @@ opencensus-ext-prometheus==0.2.1
prometheus-client==0.21.1
prometheus-flask-exporter==0.23.2
requests==2.31.0
Werkzeug==3.0.3
Werkzeug==3.1.4
2 changes: 1 addition & 1 deletion monitoring/prometheus/requirements.txt
Original file line number Diff line number Diff line change
Expand Up @@ -5,4 +5,4 @@ googleapis-common-protos==1.66.0
prometheus-client==0.21.1
prometheus-flask-exporter==0.23.2
requests==2.31.0
Werkzeug==3.0.3
Werkzeug==3.1.4
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
Flask==3.0.3
gunicorn==23.0.0
tensorflow==2.12.0
Werkzeug==3.0.3
Werkzeug==3.1.4
Original file line number Diff line number Diff line change
Expand Up @@ -3,4 +3,4 @@ Flask==3.0.3
earthengine-api==1.5.9
gunicorn==23.0.0
tensorflow==2.12.0
Werkzeug==3.0.3
Werkzeug==3.1.4
Original file line number Diff line number Diff line change
Expand Up @@ -4,4 +4,4 @@ google-cloud-aiplatform==1.47.0
gunicorn==23.0.0
pandas==2.2.3
tensorflow==2.12.1
Werkzeug==3.0.3
Werkzeug==3.1.4
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
Flask==3.0.3
gunicorn==23.0.0
Werkzeug==3.0.3
Werkzeug==3.1.4

# Local packages.
./weather-data
Expand Down
2 changes: 1 addition & 1 deletion profiler/appengine/flexible/requirements.txt
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
Flask==3.0.3
gunicorn==23.0.0
google-cloud-profiler==4.1.0
Werkzeug==3.0.3
Werkzeug==3.1.4
2 changes: 1 addition & 1 deletion recaptcha_enterprise/demosite/app/requirements.txt
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
Flask==3.0.3
gunicorn==23.0.0
google-cloud-recaptcha-enterprise==1.25.0
Werkzeug==3.0.3
Werkzeug==3.1.4
2 changes: 1 addition & 1 deletion recaptcha_enterprise/snippets/requirements-test.txt
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
selenium==4.10.0
Flask==2.2.2
Werkzeug==2.3.8
Werkzeug==3.1.4
pytest==8.2.0
pytest-flask==1.2.0
webdriver-manager==4.0.2
2 changes: 1 addition & 1 deletion run/hello-broken/requirements.txt
Original file line number Diff line number Diff line change
Expand Up @@ -3,4 +3,4 @@ pytest==8.2.0; python_version > "3.0"
# pin pytest to 4.6.11 for Python2.
pytest==4.6.11; python_version < "3.0"
gunicorn==23.0.0
Werkzeug==3.0.3
Werkzeug==3.1.4
2 changes: 1 addition & 1 deletion run/helloworld/requirements.txt
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
Flask==3.0.3
gunicorn==23.0.0
Werkzeug==3.0.3
Werkzeug==3.1.4
2 changes: 1 addition & 1 deletion run/image-processing/requirements.txt
Original file line number Diff line number Diff line change
Expand Up @@ -3,4 +3,4 @@ google-cloud-storage==2.12.0
google-cloud-vision==3.8.1
gunicorn==23.0.0
Wand==0.6.13
Werkzeug==3.0.3
Werkzeug==3.1.4
2 changes: 1 addition & 1 deletion run/logging-manual/requirements.txt
Original file line number Diff line number Diff line change
Expand Up @@ -3,4 +3,4 @@ pytest==8.2.0; python_version > "3.0"
# pin pytest to 4.6.11 for Python2.
pytest==4.6.11; python_version < "3.0"
gunicorn==23.0.0
Werkzeug==3.0.3
Werkzeug==3.1.4
2 changes: 1 addition & 1 deletion run/markdown-preview/editor/requirements.txt
Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,4 @@ Flask==3.0.3
gunicorn==23.0.0
google-auth==2.38.0
requests==2.31.0
Werkzeug==3.0.3
Werkzeug==3.1.4
2 changes: 1 addition & 1 deletion run/markdown-preview/renderer/requirements.txt
Original file line number Diff line number Diff line change
Expand Up @@ -3,4 +3,4 @@ gunicorn==23.0.0
Markdown==3.7
bleach==6.2.0; python_version >= "3.9"
bleach==6.1.0; python_version <= "3.8"
Werkzeug==3.0.3
Werkzeug==3.1.4
2 changes: 1 addition & 1 deletion run/pubsub/requirements.txt
Original file line number Diff line number Diff line change
Expand Up @@ -3,4 +3,4 @@ pytest==8.2.0; python_version > "3.0"
# pin pytest to 4.6.11 for Python2.
pytest==4.6.11; python_version < "3.0"
gunicorn==23.0.0
Werkzeug==3.0.3
Werkzeug==3.1.4
2 changes: 1 addition & 1 deletion run/system-package/requirements.txt
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
Flask==3.0.3
pytest==8.2.0
gunicorn==23.0.0
Werkzeug==3.0.3
Werkzeug==3.1.4
Original file line number Diff line number Diff line change
Expand Up @@ -5,4 +5,4 @@ opentelemetry-propagator-gcp==1.7.0
opentelemetry-instrumentation-flask==0.34b0
opentelemetry-instrumentation-requests==0.34b0
google-cloud-trace==1.14.1
Werkzeug==3.0.3
Werkzeug==3.1.4
2 changes: 1 addition & 1 deletion trace/trace-python-sample-opentelemetry/requirements.txt
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
Flask==3.0.3
opentelemetry-exporter-gcp-trace==1.7.0
opentelemetry-propagator-gcp==1.7.0
Werkzeug==3.0.3
Werkzeug==3.1.4