Skip to content

chore(deps): bump Python 3.9 to 3.11#2440

Closed
reneleonhardt wants to merge 2 commits intoblacklanternsecurity:devfrom
reneleonhardt:chore/bump-to-python3.11
Closed

chore(deps): bump Python 3.9 to 3.11#2440
reneleonhardt wants to merge 2 commits intoblacklanternsecurity:devfrom
reneleonhardt:chore/bump-to-python3.11

Conversation

@reneleonhardt
Copy link
Copy Markdown

Updates

  • Bump Python 3.9 to 3.11 to allow dependency updates (ansible 2.16+)
  • Update dependencies
  • Run tests against Python 3.11+
  • Bump Dockerfile Python 3.10 to 3.13
  • Update troubleshooting
  • Change Python version badge to read from PyPI

poetry install

Package operations: 0 installs, 21 updates, 0 removals

  - Updating certifi (2025.1.31 -> 2025.4.26)
  - Updating charset-normalizer (3.4.1 -> 3.4.2)
  - Updating h11 (0.14.0 -> 0.16.0)
  - Updating httpcore (1.0.8 -> 1.0.9)
  - Updating pydantic-core (2.33.1 -> 2.33.2)
  - Updating pymdown-extensions (10.14.3 -> 10.15)
  - Updating cryptography (43.0.3 -> 44.0.3)
  - Updating importlib-metadata (6.2.1 -> 8.7.0)
  - Updating importlib-resources (5.0.7 -> 6.5.2)
  - Updating mkdocstrings (0.28.3 -> 0.29.1)
  - Updating pydantic (2.11.3 -> 2.11.4)
  - Updating ansible-core (2.15.13 -> 2.18.5)
  - Updating cloudcheck (7.0.47 -> 7.2.11)
  - Updating orjson (3.10.16 -> 3.10.18)
  - Updating puremagic (1.28 -> 1.29)
  - Updating pytest-asyncio (0.25.3 -> 0.26.0)
  - Updating ruff (0.9.7 -> 0.11.8)
  - Updating setproctitle (1.3.5 -> 1.3.6)
  - Updating tabulate (0.8.10 -> 0.9.0)
  - Updating unidecode (1.3.8 -> 1.4.0)
  - Updating yara-python (4.5.1 -> 4.5.2)

Fixed Vulnerabilities: 4 (LOW: 2, HIGH: 1, CRITICAL: 1)

Library Vulnerability Severity Installed Fixed
ansible-core CVE-2024-8775 HIGH 2.15.13 2.17.6, 2.16.13
CVE-2024-11079 LOW 2.18.1rc1, 2.17.7rc1, 2.16.14rc1
cryptography CVE-2024-12797 43.0.3 44.0.1
h11 CVE-2025-43859 CRITICAL 0.14.0 0.16.0

@TheTechromancer
Copy link
Copy Markdown
Collaborator

We won't be dropping support for python 3.9 until BBOT 3.0.

@TheTechromancer
Copy link
Copy Markdown
Collaborator

@reneleonhardt thanks for the work on this. We're dropping support for 3.9 soon starting in the 3.0 branch, so we have to close this PR for now. Let me know if you have any questions. Specifically if you have a working proof of concept exploit against BBOT, please let us know and we talk about assigning a CVE.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants