Repository navigation
Pinned dependencies have 9 known CVEs — any plans to update? #43
Description
Hey team,
First off — love the library, it's been solid for our cTrader integration. Just flagging something we ran into while setting up CI/CD security scanning.
ctrader-open-api 0.9.2 pins a few dependencies to exact versions that currently carry 9 known CVEs:
| Package | Pinned Version | CVEs | Fixed In |
|---|---|---|---|
| protobuf | 3.20.1 | CVE-2022-1941, CVE-2025-4565, CVE-2026-0994 | 3.20.2 / 4.25.8+ / 5.29.5+ |
| Twisted | 24.3.0 | PYSEC-2024-75, CVE-2024-41671 | 24.7.0+ |
| requests | 2.32.3 (transitive) | CVE-2024-47081 | 2.32.4 |
| cryptography | 42.0.8 (transitive) | GHSA-h4gh-qq45-vh27, CVE-2024-12797, CVE-2026-26007 | 43.0.1+ / 44.0.1+ / 46.0.5+ |
Because the versions are hard-pinned (e.g. Twisted==24.3.0, protobuf==3.20.1 in pyproject.toml), we can't bump them on our end without breaking the install. We're currently working around it by ignoring these in pip-audit, but it'd be great to get them resolved upstream.
Even just loosening the pins to compatible ranges (e.g. protobuf>=3.20.2,<4 and Twisted>=24.7.0) would let downstream projects pick up the security fixes.
Would really appreciate any movement on this when you get a chance. Happy to help test if you push a pre-release.
Cheers
Activity
fix: update pinned dependencies to resolve 9 known CVEs
jovana commentedon Apr 3, 2026
The used requests version here is now almost 2 years old. We need to update this to atleast one of the latest versions. Also the CVE's are a concern.
Rusty-8 commentedon Apr 3, 2026
100% and I get their philosophy of not changing what's not broken but not having updates for 2-5+ years now it's certainly a problem waiting to happen & as of right now there's a total 11 CVE's that I've identified anyways...
Noann0 commentedon May 25, 2026
Adding a small technical note that I think makes this easier for the maintainers to action.
The four flagged packages are not all at the same level in the dependency tree, and that matters for the fix:
Directly pinned in the package metadata (
Requires-Dist):Twisted==24.3.0protobuf==3.20.1requests==2.32.3pyOpenSSL==24.1.0Transitively frozen (not pinned directly):
cryptography==42.0.8— this is pulled in bypyOpenSSL.pyOpenSSL==24.1.0requirescryptography<43,>=41.0.5, so the hard pin on pyOpenSSL is what actually blockscryptographyfrom reaching a CVE-patched release. BumpingpyOpenSSL(current26.2.0, which requirescryptography>=46.0.0) is therefore the lever for the cryptography CVEs as well.So
pyOpenSSLis worth adding to the table since it is the upstream cause of the frozencryptography.Current latest stable on PyPI (May 2026), for reference when picking floors:
Twisted26.4.0protobuf7.35.0 (a>=3.20.2,<7range probably keeps the 3.x wire-format compatibility while clearing the protobuf CVEs)requests2.34.2pyOpenSSL26.2.0cryptography48.0.0Concrete suggestion: replace the exact
==pins with minimum constraints / compatible ranges, e.g.Happy to open a PR against the pin spec if that helps — just let me know the protobuf major you want to cap at (the generated
*_pb2.pyfiles are the main compatibility consideration there).