https://linen.dev logo
Join Slack
Powered by
Hi team, we are using the Python SDK and noticed t...
# permit-saas
j
Hi team, we are using the Python SDK and noticed that there are some high and critical vulnerabilities on the dependencies such as 
anyio
and 
aiohttp
. Is there a plan to fix this? Our internal security compliance policy strictly prohibits us from deploying applications that contain third-party dependencies with unresolved vulnerabilities. Thank you.
a
Hi @Jazmine Reyes, I'm an AI assistant for Permit.io. I'll analyze available sources and get back to you shortly.
I don't have information in the available sources about specific 
anyio
or 
aiohttp
vulnerabilities in the Python SDK's dependencies, or a remediation plan for them. The sources do cover a related dependency issue: the Python SDK's use of Pydantic v1 causes an incompatibility with Python 3.14, since Pydantic v1 core functionality doesn't work on Python 3.14+(1). That GitHub Issue is currently open, and the maintainers have confirmed there's an open ticket to address it, though no timeline has been given yet(1). The reporter suggested pinning 
pydantic <= 2.11.0
as a temporary workaround while using 
httpx
directly for calls in the meantime(1). Since I don't have documentation specifically addressing 
anyio
or 
aiohttp
vulnerabilities, I can't confirm a fix or timeline for those. To help our engineers investigate this further, could you share: 1. Which Workspace / Project / Env you're using 2. The SDK code or CURL calls you're performing 3. Which PDP version you're running 4. Any relevant logs from your PDP For a security-specific report, you can also reach out via Email.
To learn more, see the sources I considered: [[1] permit sdk with pydantic v1 is incompatible with python 3.14](https://github.com/permitio/permit-python/issues/124)
o
Hi thanks for reaching out.please share your findings, and we'll create a ticket for this.
cc: @Ze'ev Manilovich, @david reminder to update
z
github.com/permitio/permit-python/pull/126 A PR is on the way, we will merge it asap.
❤️ 1
j
Hi, here are some scans from our internal Kodem for your reference.
z
Thanks @Jazmine Reyes, this will be a Major release since removing these CVEs does some breaking changes, we are aiming to release it weekend or start of next week.
🙌 1
@Jazmine Reyes the PR was merged, will release it to Pypi today.
j
Thank you! Will check on our end.
💜 1
3 Views
Open in Slack
PreviousNext
Powered by