Skip to content

Conversation

@reneleonhardt
Copy link

Updates

  • Bump Python 3.9 to 3.11 to allow dependency updates (ansible 2.16+)
  • Update dependencies
  • Run tests against Python 3.11+
  • Bump Dockerfile Python 3.10 to 3.13
  • Update troubleshooting
  • Change Python version badge to read from PyPI

poetry install

Package operations: 0 installs, 21 updates, 0 removals

  - Updating certifi (2025.1.31 -> 2025.4.26)
  - Updating charset-normalizer (3.4.1 -> 3.4.2)
  - Updating h11 (0.14.0 -> 0.16.0)
  - Updating httpcore (1.0.8 -> 1.0.9)
  - Updating pydantic-core (2.33.1 -> 2.33.2)
  - Updating pymdown-extensions (10.14.3 -> 10.15)
  - Updating cryptography (43.0.3 -> 44.0.3)
  - Updating importlib-metadata (6.2.1 -> 8.7.0)
  - Updating importlib-resources (5.0.7 -> 6.5.2)
  - Updating mkdocstrings (0.28.3 -> 0.29.1)
  - Updating pydantic (2.11.3 -> 2.11.4)
  - Updating ansible-core (2.15.13 -> 2.18.5)
  - Updating cloudcheck (7.0.47 -> 7.2.11)
  - Updating orjson (3.10.16 -> 3.10.18)
  - Updating puremagic (1.28 -> 1.29)
  - Updating pytest-asyncio (0.25.3 -> 0.26.0)
  - Updating ruff (0.9.7 -> 0.11.8)
  - Updating setproctitle (1.3.5 -> 1.3.6)
  - Updating tabulate (0.8.10 -> 0.9.0)
  - Updating unidecode (1.3.8 -> 1.4.0)
  - Updating yara-python (4.5.1 -> 4.5.2)

Fixed Vulnerabilities: 4 (LOW: 2, HIGH: 1, CRITICAL: 1)

Library Vulnerability Severity Installed Fixed
ansible-core CVE-2024-8775 HIGH 2.15.13 2.17.6, 2.16.13
CVE-2024-11079 LOW 2.18.1rc1, 2.17.7rc1, 2.16.14rc1
cryptography CVE-2024-12797 43.0.3 44.0.1
h11 CVE-2025-43859 CRITICAL 0.14.0 0.16.0

@TheTechromancer
Copy link
Collaborator

We won't be dropping support for python 3.9 until BBOT 3.0.

@TheTechromancer
Copy link
Collaborator

@reneleonhardt thanks for the work on this. We're dropping support for 3.9 soon starting in the 3.0 branch, so we have to close this PR for now. Let me know if you have any questions. Specifically if you have a working proof of concept exploit against BBOT, please let us know and we talk about assigning a CVE.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants