deps: bump deps for trixie/idf compatibility
What the developer wrote
Authored by Jon Griffiths
deps: bump deps for trixie/idf compatibility
Note that cbor2 is held back since the latest version is buggy.
What changed, and why it matters
This commit updates several Python library dependencies in Blockstream Jade's requirements file to maintain compatibility with newer Debian and ESP-IDF versions. It also bumps cbor2 from 5.4.6 to 5.7.1 (but not higher due to a known bug) and requests from 2.26.0 to 2.32.5. The newer requests version fixes known security issues in older requests versions, such as unsafe cookie handling and certificate verification problems. There is no direct evidence in the commit of an active exploit or a specific CVE being patched, and the commit message frames the change as compatibility rather than security.
Treat this as a routine dependency-maintenance commit with incidental security benefit. Verify that the pinned hashes match the upstream PyPI releases for requests 2.32.5, cbor2 5.7.1, and typing-extensions 4.15.0. Review whether the project relies on requests in security-sensitive flows (e.g., firmware update downloads, API calls) and consider validating TLS/certificate pinning behavior separately. No urgent patching action is required beyond normal dependency hygiene.
Security signals we found
Dependency version bump for requests (2.26.0 -> 2.32.5), which addresses known security issues in the older requests line
Pinned hash additions for cbor2 5.7.1 supply-chain integrity practice
Explicit note that cbor2 latest is buggy and held back, indicating awareness of upstream defects
No direct code fix or CVE reference in commit message
Evidence from the diff
The diff updates requirements.txt: cbor2 is upgraded to 5.7.1 with many pinned hashes, typing_extensions becomes typing-extensions 4.15.0, and requests is upgraded from 2.26.0 to 2.32.5. The requests upgrade is the most security-relevant, since requests 2.26.0 has known weaknesses (e.g., CVE-2024-35195 in the 2.x line related to session cookie authentication and CVE-2023-32681 related to proxy leakage). The commit message does not describe these as security fixes, only as dependency bumps for ‘trixie/idf compatibility’. cbor2 is explicitly held back from the latest version because of upstream bug agronholm/cbor2#272. No code changes are present beyond the requirements file.
Changed components
requirements.txtrequests library (Python HTTP client)cbor2 library (CBOR encoding/decoding)typing-extensions libraryInspect captured patch +59 / −7
diff --git a/requirements.txt b/requirements.txt
index 1e4dcff..8b01e3b 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,7 +1,59 @@
pyserial==3.5 \
--hash=sha256:c4451db6ba391ca6ca299fb3ec7bae67a5c55dde170964c7a14ceefec02f2cf0 \
--hash=sha256:3c77e014170dfffbd816e6ffc205e9842efb10be9f58ec16d3e8675b4925cddb
-cbor2==5.4.6 --hash=sha256:b893500db0fe033e570c3adc956af6eefc57e280026bd2d86fd53da9f1e594d7
+# Note cbor2 cannot be updated further until a fix is available for
+# https://github.com/agronholm/cbor2/issues/272
+cbor2==5.7.1 \
+ --hash=sha256:0a94c265d92ecc25b11072f5f41685a881c8d95fa64d6691db79cea6eac8c94a \
+ --hash=sha256:228e0af9c0a9ddf6375b6ae010eaa1942a1901d403f134ac9ee6a76a322483f9 \
+ --hash=sha256:25d4c7554d6627da781c9bd1d0dd0709456eecb71f605829f98961bb98487dda \
+ --hash=sha256:29f22266b5e08e0e4152e87ba185e04d3a84a4fd545b99ae3ebe42c658c66a53 \
+ --hash=sha256:2b1efbe6e82721be44b9faf47d0fd97b0150213eb6a4ba554f4947442bc4e13f \
+ --hash=sha256:2d08a6c0d9ed778448e185508d870f4160ba74f59bb17a966abd0d14d0ff4dd3 \
+ --hash=sha256:31d511df7ebd6624fdb4cecdafb4ffb9a205f9ff8c8d98edd1bef0d27f944d74 \
+ --hash=sha256:34cbbe4fcf82080412a641984a0be43dfe66eac50a8f45596da63fde36189450 \
+ --hash=sha256:3a56a92bd6070c98513eacdd3e0efbe07c373a5a1637acef94b18f141e71079e \
+ --hash=sha256:40cc9c67242a7abac5a4e062bc4d1d2376979878c0565a4b2f08fd9ed9212945 \
+ --hash=sha256:45e6a01c028b3588028995b4016009d6525b82981ab095ffaaef78798be35583 \
+ --hash=sha256:4682973d385020786ff0c8c6d9694e2428f1bb4cd82a8a0f172eaa9cd674c814 \
+ --hash=sha256:4fc3d3f00aed397a1e4634b8e1780f347aad191a2e1e7768a233baadd4f87561 \
+ --hash=sha256:4fd7225ac820bbb9f03bd16bc1a7efb6c4d1c451f22c0a153ff4ec46495c59c5 \
+ --hash=sha256:533117918d518e01348f8cd0331271c207e7224b9a1ed492a0ff00847f28edc8 \
+ --hash=sha256:537d73ef930ccc1a7b6a2e8d2cbf81407d270deb18e40cda5eb511bd70f71078 \
+ --hash=sha256:57d8cc29ec1fd20500748e0e767ff88c13afcee839081ba4478c41fcda6ee18b \
+ --hash=sha256:59b78c90a5e682e7d004586fb662be6e451ec06f32fc3a738bbfb9576c72ecc9 \
+ --hash=sha256:59d5da59fffe89692d5bd1530eef4d26e4eb7aa794aaa1f4e192614786409009 \
+ --hash=sha256:6300e0322e52f831892054f1ccf25e67fa8040664963d358db090f29d8976ae4 \
+ --hash=sha256:661b871ca754a619fcd98c13a38b4696b2b57dab8b24235c00b0ba322c040d24 \
+ --hash=sha256:68834e4eff2f56629ce6422b0634bc3f74c5a4269de5363f5265fe452c706ba7 \
+ --hash=sha256:6f17eacea2d28fecf28ac413c1d7927cde0a11957487d2630655d6b5c9c46a0b \
+ --hash=sha256:752506cfe72da0f4014b468b30191470ee8919a64a0772bd3b36a4fccf5fcefc \
+ --hash=sha256:7a405a1d7c8230ee9acf240aad48ae947ef584e8af05f169f3c1bde8f01f8b71 \
+ --hash=sha256:7badbde0d89eb7c8b9f7ef8e4f2395c02cfb24b514815656fef8e23276a7cd36 \
+ --hash=sha256:8d6d9436ff3c3323ea5863ecf7ae1139590991685b44b9eb6b7bb1734a594af6 \
+ --hash=sha256:94fb939d0946f80c49ba45105ca3a3e13e598fc9abd63efc6661b02d4b4d2c50 \
+ --hash=sha256:99e1666887a868e619096e9b5953734efd034f577e078f4efc5abd23dc1bcd32 \
+ --hash=sha256:9f6cdf7eb604ea0e7ef34e3f0b5447da0029ecd3ab7b2dc70e43fa5f7bcfca89 \
+ --hash=sha256:9fc81da8c0e09beb42923e455e477b36ff14a03b9ca18a8a2e9b462de9a953e8 \
+ --hash=sha256:a0fc6cc50e0aa04e54792e7824e65bf66c691ae2948d7c012153df2bab1ee314 \
+ --hash=sha256:bd044d65dc026f710104515359350014101eb5be86925314328ebe6221312a1c \
+ --hash=sha256:bd5ca44891c06f6b85d440836c967187dc1d30b15f86f315d55c675d3a841078 \
+ --hash=sha256:c2fe69c1473d18d102f1e20982edab5bfa543fa1cda9888bdecc49f8b2f3d720 \
+ --hash=sha256:cb1b7047d73590cfe8e373e2c804fa99be47e55b1b6186602d0f86f384cecec1 \
+ --hash=sha256:d2113aea044cd172f199da3520bc4401af69eae96c5180ca7eb660941928cb89 \
+ --hash=sha256:d65deea39cae533a629561e7da672402c46731122b6129ed7c8eaa1efe04efce \
+ --hash=sha256:d7e2d2a116108d7e4e9cda46385beed4102f8dca599a84e78bffdc5b07ebed89 \
+ --hash=sha256:d8065aa90d715fd9bb28727b2d774ee16e695a0e1627ae76e54bf19f9d99d63f \
+ --hash=sha256:dd25cbef8e8e6dbf69f0de95311aecaca7217230cda83ae99fdc37cd20d99250 \
+ --hash=sha256:e2f2e226066b801d1015c632a8309e3b322e5f1488a4472ffc8310bbf1386d84 \
+ --hash=sha256:e4a7d660d428911a3aadb7105e94438d7671ab977356fdf647a91aab751033bd \
+ --hash=sha256:e5826e4fa4c33661960073f99cf67c82783895524fb66f3ebdd635c19b5a7d68 \
+ --hash=sha256:edbf814dd7763b6eda27a5770199f6ccd55bd78be8f4367092460261bfbf19d0 \
+ --hash=sha256:f19a00d6ac9a77cb611073250b06bf4494b41ba78a1716704f7008e0927d9366 \
+ --hash=sha256:f1e15c3a08008cf13ce1dfc64d17c960df5d66d935788d28ec7df54bf0ffb0ef \
+ --hash=sha256:f5d37f7b0f84394d2995bd8722cb01c86a885c4821a864a34b7b4d9950c5e26e \
+ --hash=sha256:f6f342a3a745f8aecc0a6253ea45952dbaf9ffdfeb641490298b3b92074365c7 \
+ --hash=sha256:fb94bab27e00283bdd8f160e125e17dbabec4c9e6ffc8da91c36547ec1eb707f
pycodestyle==2.8.0 \
--hash=sha256:720f8b39dde8b293825e7ff02c475f3077124006db4f440dcbc9a20b76548a20 \
--hash=sha256:eddd5847ef438ea1c7870ca7eb78a9d47ce0cdb4851a5523949f2601d0cbbe7f
@@ -64,9 +116,9 @@ pycryptodome==3.20.0 \
--hash=sha256:09609209ed7de61c2b560cc5c8c4fbf892f8b15b1faf7e4cbffac97db1fffda7
# aioitertools and deps
-typing_extensions==4.0.1 \
- --hash=sha256:7f001e5ac290a0c0401508864c7ec868be4e701886d5b573a9528ed3973d9d3b \
- --hash=sha256:4ca091dea149f945ec56afb48dae714f21e8692ef22a395223bcd328961b6a0e
+typing-extensions==4.15.0 \
+ --hash=sha256:0cea48d173cc12fa28ecabc3b837ea3cf6f38c6d1136f85cbaaf598984861466 \
+ --hash=sha256:f0fa19c6845758ab08074a0cfa8b7aecb71c999ca73d62883bc25cc018c4e548
aioitertools==0.8.0 \
--hash=sha256:3a141f01d1050ac8c01917aee248d262736dab875ce0471f0dba5f619346b452 \
--hash=sha256:8b02facfbc9b0f1867739949a223f3d3267ed8663691cc95abd94e2c1d8c2b46
@@ -92,9 +144,9 @@ urllib3==1.26.7 \
charset_normalizer==2.0.8 \
--hash=sha256:83fcdeb225499d6344c8f7f34684c2981270beacc32ede2e669e94f7fa544405 \
--hash=sha256:735e240d9a8506778cd7a453d97e817e536bb1fc29f4f6961ce297b9c7a917b0
-requests==2.26.0 \
- --hash=sha256:6c1246513ecd5ecd4528a0906f910e8f0f9c6b8ec72030dc9fd154dc1a6efd24 \
- --hash=sha256:b8aa58f8cf793ffd8782d3d8cb19e66ef36f7aba4353eec859e74678b01b07a7
+requests==2.32.5 \
+ --hash=sha256:2462f94637a34fd532264295e186976db0f5d453d1cdd31473c85a6a161affb6 \
+ --hash=sha256:dbba0bac56e100853db0ea71b82b4dfd5fe2bf6d3754a8893c3af500cec7d7cf
# logo/firmware compression
zopfli==0.2.3.post1 \
Why this scored 24/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.