You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Bumps psycopg2-binary from 2.9.11 to 2.9.13. No advisory has been published for 2.9.11 yet. The bump follows the process this repository uses for audit findings, because 2.9.12 and 2.9.13 fix parsing of malformed server input.
Audit
Command:poetry export <matrix export-args> -f requirements.txt, then pypa/gh-action-pip-audit with require-hashes: true, disable-pip: true, ignoring PYSEC-2024-161 and PYSEC-2026-113, on Python 3.11 (.github/workflows/ci.yml:516, :518). It runs three times: Production (--without dev), Server (--extras server), Dev (--only dev).
Result on this branch:
Dev passes.
Production and Server report no psycopg2-binary findings.
Production and Server fail on oauthlib 4.0.0 (CVE-2026-49272, fix version now 4.0.1). main fails the same way. This is not caused by this PR; see "Not fixed".
Effect on user environments: when DEEPNOTE_ENFORCE_PIP_CONSTRAINTS is on, the published constraints file now rejects user pins below 2.9.13 (deepnote_core/execution/registry.py:155). This is the same effect every earlier floor raise had.
Bundled libraries: libpq 17.6 → 17.11 and OpenSSL 3.5.4 → 3.5.8, both patch updates in the same series. aarch64 Linux wheels now need glibc 2.28 instead of 2.17.
- "psycopg2-binary>=2.9.4,<2.10; python_version < '3.13'",
- "psycopg2-binary>=2.9.10,<3; python_version>='3.13'",
+ "psycopg2-binary>=2.9.13,<3", # 2.9.12 and 2.9.13 fix parsing of malformed interval, bytea and int8-array input
Verified
The spliced lock block is byte-identical to what Poetry 2.2.0 generates.
All 67 file hashes match PyPI.
Every export resolves psycopg2-binary==2.9.13.
Unit suite: 1462 passed, 4 skipped, 13 warnings, identical before and after the bump.
Round-trip against a Postgres 17 container with the toolkit's wait_select callback: interval, bytea and extreme int8 values in an array parse correctly, and statement_timeout cancellation raises QueryCanceled.
Decided with the user
Scope: bump only psycopg2, to 2.9.13, handled like a vulnerability fix although no advisory exists.
oauthlib: not fixed here, because it is outside that scope.
Checks
Command
Result
poetry check --lock (Poetry 2.2.0)
exit 0
Spliced lock compared block-by-block with base and with a fresh poetry lock
only psycopg2-binary and content-hash differ from base
pip-audit==2.10.1 on Python 3.11, CI flags and ignores, three exports
Dev clean; Production and Server: only oauthlib CVE-2026-49272 (same on main)
pytest tests/unit on Python 3.13, before / after
1462 passed, 4 skipped / 1462 passed, 4 skipped
Postgres 17 round-trip with set_wait_callback(wait_select)
pass
Not fixed
oauthlib 4.0.0, CVE-2026-49272: the advisory now lists 4.0.1 as the fix. oauthlib 4.0.1 was released on 2026-10-31, and main's last green CI run was on 2026-11-05, so the advisory data has changed since. It reaches users through databricks-sql-connector and is pinned by the oauthlib>=4.0.0,<5 floor from fix(deps): resolve pip-audit failures for pymongo, dnspython, oauthlib and pylint #145. The Production and Server audit jobs will stay red on this PR until it is fixed in its own PR.
Summary by CodeRabbit
Compatibility
Updated package compatibility across supported Python versions.
The dependency floor is raised to 2.9.13. No concrete merge-blocking issue has been established.
Pre-merge checks: 5
Check name
Status
Explanation
Description Check
Check skipped - CodeRabbit’s high-level summary is enabled.
Title check
The title clearly summarizes the dependency update to psycopg2-binary 2.9.13.
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Updates Docs
This PR updates a dependency and its lockfile; it does not implement a feature. The linked repositories are unavailable for inspection. Please check their documentation and roadmap if an update is nee…
Full details: Updates Docs
Explanation
This PR updates a dependency and its lockfile; it does not implement a feature. The linked repositories are unavailable for inspection. Please check their documentation and roadmap if an update is needed.
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Recent review info
Run configuration
Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Essentials
Run ID: 72117e1d-5fc3-486d-b368-317860fbef49
Commits
Reviewing files that changed from the base of the PR and between 3122452 and 0bb86ff.
Files ignored due to path filters: 1
poetry.lock is excluded by !**/*.lock
Files selected for processing: 1
pyproject.toml
Included review availability: This review used your included allowance. 3 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.
✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.43%. Comparing base (b6b7dbd) to head (ad79fde).
✅ All tests successful. No failed tests found.
psycopg2-binary 2.9.12 and 2.9.13 fix an infinite loop on a malformed
interval and the parsing of malformed bytea and int64-array input. No
advisory is published for them yet; the floor is raised the way past
audit fixes raise one.
2.9.13 requires Python 3.10 and ships wheels for 3.10 to 3.14, so the
per-Python split, which existed only because 2.9.10 was the first
release with 3.13 wheels, collapses into one constraint with the newer
line's <3 ceiling, as was done for pymongo and pylint.
Only the psycopg2-binary block and content-hash were spliced into the
lock.
…149)
* fix(ci): install Poetry with pipx instead of snok/install-poetry
Every job that installs Poetry through snok/install-poetry fails with
HTTP 403. The action downloads https://install.python-poetry.org/ with
Python's urllib, and the Cloudflare front of that host now rejects the
Python-urllib User-Agent with error 1010. The action's latest release
makes the same request, so bumping it does not help.
Poetry is installed from PyPI with the runner's preinstalled pipx
instead, as dockerfiles/test.Dockerfile already does. The settings the
action applied are already set by the workflow-level POETRY_* env vars.
The runner image points pipx at /opt, so the two jobs that cache
~/.local for their Poetry install redirect pipx there; otherwise the
cache would save nothing and a later cache hit would leave poetry
missing.
* fix(deps): bump psycopg2-binary to 2.9.13 (#148)
psycopg2-binary 2.9.12 and 2.9.13 fix an infinite loop on a malformed
interval and the parsing of malformed bytea and int64-array input. No
advisory is published for them yet; the floor is raised the way past
audit fixes raise one.
2.9.13 requires Python 3.10 and ships wheels for 3.10 to 3.14, so the
per-Python split, which existed only because 2.9.10 was the first
release with 3.13 wheels, collapses into one constraint with the newer
line's <3 ceiling, as was done for pymongo and pylint.
Only the psycopg2-binary block and content-hash were spliced into the
lock.
* fix(deps): bump oauthlib to 4.0.1
CVE-2026-49272 (GHSA-3jp2-3mrg-2vxc) was revised on 2026-11-05 to name
4.0.1 as its fix, so pip-audit fails Production and Server on 4.0.0.
4.0.1 changes only the server-side device flow; databricks-sql-connector,
the only consumer, uses oauthlib as a client and allows <5. The floor in
the transitive security block is raised in place, as for pyasn1.
Only the oauthlib block and content-hash were spliced into the lock.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Bumps
psycopg2-binaryfrom 2.9.11 to 2.9.13. No advisory has been published for 2.9.11 yet. The bump follows the process this repository uses for audit findings, because 2.9.12 and 2.9.13 fix parsing of malformed server input.Audit
poetry export <matrix export-args> -f requirements.txt, thenpypa/gh-action-pip-auditwithrequire-hashes: true,disable-pip: true, ignoringPYSEC-2024-161andPYSEC-2026-113, on Python 3.11 (.github/workflows/ci.yml:516,:518). It runs three times: Production (--without dev), Server (--extras server), Dev (--only dev).psycopg2-binaryfindings.oauthlib4.0.0 (CVE-2026-49272, fix version now 4.0.1).mainfails the same way. This is not caused by this PR; see "Not fixed".Precedent
pyproject.toml, with a trailing comment that says why. Examples: pymongo, urllib3 and pyjwt (fix(deps): resolve pip-audit failures #133), snowflake-sqlalchemy (fix(deps): resolve pip-audit failures for snowflake-sqlalchemy, thrift and tornado #126), pymongo (fix(deps): resolve pip-audit failures for pymongo, dnspython, oauthlib and pylint #145).<4.10/<5→<5(fix(deps): resolve pip-audit failures #133), pylint 3.x / 4.x → one line (fix(deps): resolve pip-audit failures for pymongo, dnspython, oauthlib and pylint #145).poetry.lockblocks andcontent-hashare spliced in, because a plainpoetry lockwith Poetry 2.2.0 also drops about 20 unrelated older-Python entries (fix(deps): resolve pip-audit failures for pillow, gitpython, certifi and black #143–fix(deps): resolve pip-audit failures for tornado and pyasn1 #146).fix(deps):titles; a single-package bump is titledfix(deps): bump <package> to <version>(fix(deps): bump deepnote-python-lsp-server to 1.13.1.1 #132).psycopg2-binary 2.9.11 → 2.9.13
maingroup). No other locked package depends on psycopg2.<3ceiling as in fix(deps): resolve pip-audit failures #133/fix(deps): resolve pip-audit failures for pymongo, dnspython, oauthlib and pylint #145. On 3.10–3.12 the ceiling widens from<2.10to<3. That changes nothing today: no 2.10 exists or is announced.DEEPNOTE_ENFORCE_PIP_CONSTRAINTSis on, the published constraints file now rejects user pins below 2.9.13 (deepnote_core/execution/registry.py:155). This is the same effect every earlier floor raise had.Verified
psycopg2-binary==2.9.13.wait_selectcallback: interval, bytea and extreme int8 values in an array parse correctly, andstatement_timeoutcancellation raisesQueryCanceled.Decided with the user
Checks
poetry check --lock(Poetry 2.2.0)poetry lockpsycopg2-binaryandcontent-hashdiffer from basepip-audit==2.10.1on Python 3.11, CI flags and ignores, three exportsmain)pytest tests/uniton Python 3.13, before / afterset_wait_callback(wait_select)Not fixed
oauthlib4.0.0, CVE-2026-49272: the advisory now lists 4.0.1 as the fix. oauthlib 4.0.1 was released on 2026-10-31, andmain's last green CI run was on 2026-11-05, so the advisory data has changed since. It reaches users throughdatabricks-sql-connectorand is pinned by theoauthlib>=4.0.0,<5floor from fix(deps): resolve pip-audit failures for pymongo, dnspython, oauthlib and pylint #145. The Production and Server audit jobs will stay red on this PR until it is fixed in its own PR.Summary by CodeRabbit