chore(deps): bump urllib3 from 2.6.0 to 2.7.0 in /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent by dependabot[bot] · Pull Request #1476 · awslabs/agentcore-samples

dependabot · 2026-05-11T15:58:45Z

Bumps urllib3 from 2.6.0 to 2.7.0.

Release notes

2.7.0

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Security

Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.

Decompression-bomb safeguards of the streaming API were bypassed:

When HTTPResponse.drain_conn() was called after the response had been read and decompressed partially. (Reported by @Cycloctane)

During the second HTTPResponse.read(amt=N) or HTTPResponse.stream(amt=N) call when the response was decompressed using the official Brotli library. (Reported by @kimkou2024)

See GHSA-mf9v-mfxr-j63j for details.

HTTP pools created using ProxyManager.connection_from_url did not strip sensitive headers specified in Retry.remove_headers_on_redirect when redirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by @christos-spearbit)

Deprecations and Removals

Used FutureWarning instead of DeprecationWarning for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. (urllib3/urllib3#3763)

Removed support for end-of-life Python 3.9. (urllib3/urllib3#3720)

Removed support for end-of-life PyPy3.10. (urllib3/urllib3#4979)

Bumped the minimum supported pyOpenSSL version to 19.0.0. (urllib3/urllib3#3777)

Bugfixes

Fixed a bug where HTTPResponse.read(amt=None) was ignoring decompressed data buffered from previous partial reads. (urllib3/urllib3#3636)

Fixed a bug where HTTPResponse.read() could cache only part of the response after a partial read when cache_content=True. (urllib3/urllib3#4967)

Fixed HTTPResponse.stream() and HTTPResponse.read_chunked() to handle amt=0. (urllib3/urllib3#3793)

Updated _TYPE_BODY type alias to include missing Iterable[str], matching the documented and runtime behavior of chunked request bodies. (urllib3/urllib3#3798)

Fixed LocationParseError when paths resembling schemeless URIs were passed to HTTPConnectionPool.urlopen(). (urllib3/urllib3#3352)

Fixed BaseHTTPResponse.readinto() type annotation to accept memoryview in addition to bytearray, matching the io.RawIOBase.readinto contract and enabling use with io.BufferedReader without type errors. (urllib3/urllib3#3764)

2.6.3

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Changes

Fixed a security issue where decompression-bomb safeguards of the streaming API were bypassed when HTTP redirects were followed. (CVE-2026-21441 reported by @D47A, 8.9 High, GHSA-38jv-5279-wg99)

Started treating Retry-After times greater than 6 hours as 6 hours by default. (urllib3/urllib3#3743)

Fixed urllib3.connection.VerifiedHTTPSConnection on Emscripten. (urllib3/urllib3#3752)

2.6.2

... (truncated)

Changelog

Sourced from urllib3's changelog.

2.7.0 (2026-05-07)

Security

Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.

Decompression-bomb safeguards of the streaming API were bypassed:

When HTTPResponse.drain_conn() was called after the response had been read and decompressed partially.

During the second HTTPResponse.read(amt=N) or HTTPResponse.stream(amt=N) call when the response was decompressed using the official Brotli <https://pypi.org/project/brotli/>__ library.

See GHSA-mf9v-mfxr-j63j <https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j>__ for details.

HTTP pools created using ProxyManager.connection_from_url did not strip sensitive headers specified in Retry.remove_headers_on_redirect when redirecting to a different host. (GHSA-qccp-gfcp-xxvc <https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc>__)

Deprecations and Removals

Used FutureWarning instead of DeprecationWarning for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. ([#3763](https://github.com/urllib3/urllib3/issues/3763) <https://github.com/urllib3/urllib3/issues/3763>__)

Removed support for end-of-life Python 3.9. ([#3720](https://github.com/urllib3/urllib3/issues/3720) <https://github.com/urllib3/urllib3/issues/3720>__)

Removed support for end-of-life PyPy3.10. ([#4979](https://github.com/urllib3/urllib3/issues/4979) <https://github.com/urllib3/urllib3/issues/4979>__)

Bumped the minimum supported pyOpenSSL version to 19.0.0. ([#3777](https://github.com/urllib3/urllib3/issues/3777) <https://github.com/urllib3/urllib3/issues/3777>__)

Bugfixes

Fixed a bug where HTTPResponse.read(amt=None) was ignoring decompressed data buffered from previous partial reads. ([#3636](https://github.com/urllib3/urllib3/issues/3636) <https://github.com/urllib3/urllib3/issues/3636>__)

Fixed a bug where HTTPResponse.read() could cache only part of the response after a partial read when cache_content=True.

... (truncated)

Commits

9a950b9 Release 2.7.0
5ec0de4 Merge commit from fork
2bdcc44 Merge commit from fork
f45b0df Fix a misleading example for ProxyManager (#4970)
577193c Switch to nightly PyPy3.11 in CI for now (#4984)
e90af45 Avoid infinite loop in HTTPResponse.read_chunked when amt=0 (#4974)
67ed74f Bump dev dependencies (#4972)
3abd481 Upgrade mypy to version 1.20.2 (#4978)
2b8725d Drop support for EOL PyPy3.10 (#4979)
2944b2a Upgrade setup-chrome and setup-firefox to fix warnings (#4973)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.6.0 to 2.7.0. - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](urllib3/urllib3@2.6.0...2.7.0) --- updated-dependencies: - dependency-name: urllib3 dependency-version: 2.7.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-05-11T16:04:20Z

Latest scan for commit: 48679b7 | Updated: 2026-05-11 16:04:19 UTC

Security Scan Results

Scan Metadata

Project: ASH
Scan executed: 2026-05-11T16:04:03+00:00
ASH version: 3.0.0

Summary

Scanner Results

The table below shows findings by scanner, with status based on severity thresholds and dependencies:

Column Explanations:

Severity Levels (S/C/H/M/L/I):

Suppressed (S): Security findings that have been explicitly suppressed/ignored and don't affect the scanner's pass/fail status
Critical (C): The most severe security vulnerabilities requiring immediate remediation (e.g., SQL injection, remote code execution)
High (H): Serious security vulnerabilities that should be addressed promptly (e.g., authentication bypasses, privilege escalation)
Medium (M): Moderate security risks that should be addressed in normal development cycles (e.g., weak encryption, input validation issues)
Low (L): Minor security concerns with limited impact (e.g., information disclosure, weak recommendations)
Info (I): Informational findings for awareness with minimal security risk (e.g., code quality suggestions, best practice recommendations)

Other Columns:

Time: Duration taken by each scanner to complete its analysis
Action: Total number of actionable findings at or above the configured severity threshold that require attention

Scanner Results:

PASSED: Scanner found no security issues at or above the configured severity threshold - code is clean for this scanner
FAILED: Scanner found security vulnerabilities at or above the threshold that require attention and remediation
MISSING: Scanner could not run because required dependencies/tools are not installed or available
SKIPPED: Scanner was intentionally disabled or excluded from this scan
ERROR: Scanner encountered an execution error and could not complete successfully

Severity Thresholds (Thresh Column):

CRITICAL: Only Critical severity findings cause scanner to fail
HIGH: High and Critical severity findings cause scanner to fail
MEDIUM (MED): Medium, High, and Critical severity findings cause scanner to fail
LOW: Low, Medium, High, and Critical severity findings cause scanner to fail
ALL: Any finding of any severity level causes scanner to fail

Threshold Source: Values in parentheses indicate where the threshold is configured:

(g) = global: Set in the global_settings section of ASH configuration
(c) = config: Set in the individual scanner configuration section
(s) = scanner: Default threshold built into the scanner itself

Statistics calculation:

All statistics are calculated from the final aggregated SARIF report
Suppressed findings are counted separately and do not contribute to actionable findings
Scanner status is determined by comparing actionable findings to the threshold

Scanner	C	M	L	Time	Action	Result	Thresh
bandit	0	0	0	736ms	0	PASSED	MED (g)
cdk-nag	0	0	0	31.2s	0	PASSED	MED (g)
cfn-nag	0	0	0	6ms	0	PASSED	MED (g)
checkov	0	0	0	5.6s	0	PASSED	MED (g)
detect-secr…	0	0	0	728ms	0	PASSED	MED (g)
grype	21	17	11	42.4s	38	FAILED	MED (g)
npm-audit	0	0	0	183ms	0	PASSED	MED (g)
opengrep	0	0	0	<1ms	0	SKIPPED	MED (g)
semgrep	0	0	0	<1ms	0	MISSING	MED (g)
syft	0	0	0	2.2s	0	PASSED	MED (g)

Detailed Findings

Show 38 actionable findings

Finding 1: GHSA-53mr-6c8q-9789-litellm

Severity: HIGH
Scanner: grype
Rule ID: GHSA-53mr-6c8q-9789-litellm
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A high vulnerability in python package: litellm, version 1.78.2 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 2: GHSA-rg7c-g689-fr3x-google-adk

Severity: HIGH
Scanner: grype
Rule ID: GHSA-rg7c-g689-fr3x-google-adk
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A critical vulnerability in python package: google-adk, version 1.16.0 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 3: GHSA-wp53-j4wj-2cfg-python-multipart

Severity: HIGH
Scanner: grype
Rule ID: GHSA-wp53-j4wj-2cfg-python-multipart
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A high vulnerability in python package: python-multipart, version 0.0.20 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 4: GHSA-7f5h-v6xp-fcq8-starlette

Severity: HIGH
Scanner: grype
Rule ID: GHSA-7f5h-v6xp-fcq8-starlette
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A high vulnerability in python package: starlette, version 0.48.0 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 5: GHSA-wh2j-26j7-9728-google-cloud-aiplatform

Severity: HIGH
Scanner: grype
Rule ID: GHSA-wh2j-26j7-9728-google-cloud-aiplatform
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A high vulnerability in python package: google-cloud-aiplatform, version 1.121.0 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 6: GHSA-jjhc-v7c2-5hh6-litellm

Severity: HIGH
Scanner: grype
Rule ID: GHSA-jjhc-v7c2-5hh6-litellm
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A critical vulnerability in python package: litellm, version 1.78.2 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 7: GHSA-c427-h43c-vf67-aiohttp

Severity: MEDIUM
Scanner: grype
Rule ID: GHSA-c427-h43c-vf67-aiohttp
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A medium vulnerability in python package: aiohttp, version 3.13.0 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 8: GHSA-qv8j-hgpc-vrq8-google-cloud-aiplatform

Severity: HIGH
Scanner: grype
Rule ID: GHSA-qv8j-hgpc-vrq8-google-cloud-aiplatform
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A high vulnerability in python package: google-cloud-aiplatform, version 1.121.0 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 9: GHSA-wvwj-cvrp-7pv5-authlib

Severity: HIGH
Scanner: grype
Rule ID: GHSA-wvwj-cvrp-7pv5-authlib
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A critical vulnerability in python package: authlib, version 1.6.5 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 10: GHSA-6mq8-rvhq-8wgg-aiohttp

Severity: HIGH
Scanner: grype
Rule ID: GHSA-6mq8-rvhq-8wgg-aiohttp
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A high vulnerability in python package: aiohttp, version 3.13.0 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 11: GHSA-v92g-xgxw-vvmm-mako

Severity: MEDIUM
Scanner: grype
Rule ID: GHSA-v92g-xgxw-vvmm-mako
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A medium vulnerability in python package: mako, version 1.3.10 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 12: GHSA-6jhg-hg63-jvvf-aiohttp

Severity: MEDIUM
Scanner: grype
Rule ID: GHSA-6jhg-hg63-jvvf-aiohttp
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A medium vulnerability in python package: aiohttp, version 3.13.0 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 13: GHSA-jj3x-wxrx-4x23-aiohttp

Severity: MEDIUM
Scanner: grype
Rule ID: GHSA-jj3x-wxrx-4x23-aiohttp
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A medium vulnerability in python package: aiohttp, version 3.13.0 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 14: GHSA-v4p8-mg3p-g94g-litellm

Severity: HIGH
Scanner: grype
Rule ID: GHSA-v4p8-mg3p-g94g-litellm
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A high vulnerability in python package: litellm, version 1.78.2 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 15: GHSA-g84x-mcqj-x9qq-aiohttp

Severity: MEDIUM
Scanner: grype
Rule ID: GHSA-g84x-mcqj-x9qq-aiohttp
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A medium vulnerability in python package: aiohttp, version 3.13.0 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 16: GHSA-p998-jp59-783m-aiohttp

Severity: MEDIUM
Scanner: grype
Rule ID: GHSA-p998-jp59-783m-aiohttp
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A medium vulnerability in python package: aiohttp, version 3.13.0 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 17: GHSA-m5qp-6w8w-w647-aiohttp

Severity: MEDIUM
Scanner: grype
Rule ID: GHSA-m5qp-6w8w-w647-aiohttp
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A medium vulnerability in python package: aiohttp, version 3.13.0 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 18: GHSA-w2fm-2cpv-w7v5-aiohttp

Severity: MEDIUM
Scanner: grype
Rule ID: GHSA-w2fm-2cpv-w7v5-aiohttp
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A medium vulnerability in python package: aiohttp, version 3.13.0 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 19: GHSA-jr27-m4p2-rc6r-pyasn1

Severity: HIGH
Scanner: grype
Rule ID: GHSA-jr27-m4p2-rc6r-pyasn1
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A high vulnerability in python package: pyasn1, version 0.6.1 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 20: GHSA-m344-f55w-2m6j-authlib

Severity: HIGH
Scanner: grype
Rule ID: GHSA-m344-f55w-2m6j-authlib
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A high vulnerability in python package: authlib, version 1.6.5 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 21: GHSA-63vm-454h-vhhq-pyasn1

Severity: HIGH
Scanner: grype
Rule ID: GHSA-63vm-454h-vhhq-pyasn1
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A high vulnerability in python package: pyasn1, version 0.6.1 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 22: GHSA-fg6f-75jq-6523-authlib

Severity: MEDIUM
Scanner: grype
Rule ID: GHSA-fg6f-75jq-6523-authlib
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A medium vulnerability in python package: authlib, version 1.6.5 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 23: GHSA-p423-j2cm-9vmq-cryptography

Severity: MEDIUM
Scanner: grype
Rule ID: GHSA-p423-j2cm-9vmq-cryptography
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A medium vulnerability in python package: cryptography, version 46.0.3 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 24: GHSA-7wc2-qxgw-g8gg-authlib

Severity: HIGH
Scanner: grype
Rule ID: GHSA-7wc2-qxgw-g8gg-authlib
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A high vulnerability in python package: authlib, version 1.6.5 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 25: GHSA-7432-952r-cw78-authlib

Severity: HIGH
Scanner: grype
Rule ID: GHSA-7432-952r-cw78-authlib
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A high vulnerability in python package: authlib, version 1.6.5 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 26: GHSA-mj87-hwqh-73pj-python-multipart

Severity: MEDIUM
Scanner: grype
Rule ID: GHSA-mj87-hwqh-73pj-python-multipart
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A medium vulnerability in python package: python-multipart, version 0.0.20 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 27: GHSA-7gcm-g887-7qv7-protobuf

Severity: HIGH
Scanner: grype
Rule ID: GHSA-7gcm-g887-7qv7-protobuf
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A high vulnerability in python package: protobuf, version 6.33.0 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 28: GHSA-752w-5fwx-jx9f-pyjwt

Severity: HIGH
Scanner: grype
Rule ID: GHSA-752w-5fwx-jx9f-pyjwt
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A high vulnerability in python package: pyjwt, version 2.11.0 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 29: GHSA-jj8c-mmj3-mmgv-authlib

Severity: MEDIUM
Scanner: grype
Rule ID: GHSA-jj8c-mmj3-mmgv-authlib
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A medium vulnerability in python package: authlib, version 1.6.5 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 30: GHSA-r6ph-v2qm-q3c2-cryptography

Severity: HIGH
Scanner: grype
Rule ID: GHSA-r6ph-v2qm-q3c2-cryptography
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A high vulnerability in python package: cryptography, version 46.0.3 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 31: GHSA-mf9w-mj56-hr94-python-dotenv

Severity: MEDIUM
Scanner: grype
Rule ID: GHSA-mf9w-mj56-hr94-python-dotenv
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A medium vulnerability in python package: python-dotenv, version 1.1.1 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 32: GHSA-gc5v-m9x4-r6x2-requests

Severity: MEDIUM
Scanner: grype
Rule ID: GHSA-gc5v-m9x4-r6x2-requests
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A medium vulnerability in python package: requests, version 2.32.5 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 33: GHSA-w853-jp5j-5j7f-filelock

Severity: MEDIUM
Scanner: grype
Rule ID: GHSA-w853-jp5j-5j7f-filelock
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A medium vulnerability in python package: filelock, version 3.20.0 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 34: GHSA-qmgc-5h2g-mvrw-filelock

Severity: MEDIUM
Scanner: grype
Rule ID: GHSA-qmgc-5h2g-mvrw-filelock
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A medium vulnerability in python package: filelock, version 3.20.0 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 35: GHSA-69x8-hrgq-fjj8-litellm

Severity: HIGH
Scanner: grype
Rule ID: GHSA-69x8-hrgq-fjj8-litellm
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A high vulnerability in python package: litellm, version 1.78.2 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 36: GHSA-2h4p-vjrc-8xpq-mako

Severity: HIGH
Scanner: grype
Rule ID: GHSA-2h4p-vjrc-8xpq-mako
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A high vulnerability in python package: mako, version 1.3.10 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 37: GHSA-pp6c-gr5w-3c5g-python-multipart

Severity: HIGH
Scanner: grype
Rule ID: GHSA-pp6c-gr5w-3c5g-python-multipart
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A high vulnerability in python package: python-multipart, version 0.0.20 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Finding 38: GHSA-27jp-wm6q-gp25-sqlparse

Severity: MEDIUM
Scanner: grype
Rule ID: GHSA-27jp-wm6q-gp25-sqlparse
Location: 02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt:1

Description:
A medium vulnerability in python package: sqlparse, version 0.5.3 was found at: /02-use-cases/A2A-multi-agent-incident-response/host_adk_agent/requirements.txt

Report generated by Automated Security Helper (ASH) at 2026-05-11T16:03:55+00:00

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels May 11, 2026

github-actions Bot added the 02-use-cases 02-use-cases label May 11, 2026

Conversation

dependabot Bot commented on behalf of github May 11, 2026

2.7.0

🚀 urllib3 is fundraising for HTTP/2 support

Security

Deprecations and Removals

Bugfixes

2.6.3

🚀 urllib3 is fundraising for HTTP/2 support

Changes

2.6.2

2.7.0 (2026-05-07)

Security

Deprecations and Removals

Bugfixes

Uh oh!

github-actions Bot commented May 11, 2026

Security Scan Results

Scan Metadata

Summary

Scanner Results

Detailed Findings

Finding 1: GHSA-53mr-6c8q-9789-litellm

Finding 2: GHSA-rg7c-g689-fr3x-google-adk

Finding 3: GHSA-wp53-j4wj-2cfg-python-multipart

Finding 4: GHSA-7f5h-v6xp-fcq8-starlette

Finding 5: GHSA-wh2j-26j7-9728-google-cloud-aiplatform

Finding 6: GHSA-jjhc-v7c2-5hh6-litellm

Finding 7: GHSA-c427-h43c-vf67-aiohttp

Finding 8: GHSA-qv8j-hgpc-vrq8-google-cloud-aiplatform

Finding 9: GHSA-wvwj-cvrp-7pv5-authlib

Finding 10: GHSA-6mq8-rvhq-8wgg-aiohttp

Finding 11: GHSA-v92g-xgxw-vvmm-mako

Finding 12: GHSA-6jhg-hg63-jvvf-aiohttp

Finding 13: GHSA-jj3x-wxrx-4x23-aiohttp

Finding 14: GHSA-v4p8-mg3p-g94g-litellm

Finding 15: GHSA-g84x-mcqj-x9qq-aiohttp

Finding 16: GHSA-p998-jp59-783m-aiohttp

Finding 17: GHSA-m5qp-6w8w-w647-aiohttp

Finding 18: GHSA-w2fm-2cpv-w7v5-aiohttp

Finding 19: GHSA-jr27-m4p2-rc6r-pyasn1

Finding 20: GHSA-m344-f55w-2m6j-authlib

Finding 21: GHSA-63vm-454h-vhhq-pyasn1

Finding 22: GHSA-fg6f-75jq-6523-authlib

Finding 23: GHSA-p423-j2cm-9vmq-cryptography

Finding 24: GHSA-7wc2-qxgw-g8gg-authlib

Finding 25: GHSA-7432-952r-cw78-authlib

Finding 26: GHSA-mj87-hwqh-73pj-python-multipart

Finding 27: GHSA-7gcm-g887-7qv7-protobuf

Finding 28: GHSA-752w-5fwx-jx9f-pyjwt

Finding 29: GHSA-jj8c-mmj3-mmgv-authlib

Finding 30: GHSA-r6ph-v2qm-q3c2-cryptography

Finding 31: GHSA-mf9w-mj56-hr94-python-dotenv

Finding 32: GHSA-gc5v-m9x4-r6x2-requests

Finding 33: GHSA-w853-jp5j-5j7f-filelock

Finding 34: GHSA-qmgc-5h2g-mvrw-filelock

Finding 35: GHSA-69x8-hrgq-fjj8-litellm

Finding 36: GHSA-2h4p-vjrc-8xpq-mako

Finding 37: GHSA-pp6c-gr5w-3c5g-python-multipart

Finding 38: GHSA-27jp-wm6q-gp25-sqlparse

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants