← Watch feed
chore: require urllib3 >2.6 security fix for CVE-2025-66471 urllib3 is dependency of requests and translate, used in dev tools
Public commit record
98/100 · Strong
What the developer wrote
Authored by odudex
chore: require urllib3 >2.6
security fix for CVE-2025-66471
urllib3 is dependency of requests and translate, used in dev tools
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
What changed, and why it matters
This commit updates the project's Python dependency lock file to require urllib3 version 2.6.0 or newer. The commit message says this is a security fix for CVE-2025-66471, a vulnerability in the urllib3 library. urllib3 is used indirectly through other packages (requests and translate) and only in development tools, not in the main Krux firmware that runs on hardware wallets. The change itself is a routine dependency bump, not a code fix inside Krux.
Recommended action
Verify that the urllib3 2.6.0 package hash in poetry.lock matches the official PyPI release. Confirm that urllib3, requests, and translate are not bundled into the firmware build or any production artifact. Continue monitoring CVE-2025-66471 for future patches and consider pinning to a newer patch release if one becomes available.
Security signals we found
01
Dependency version bump for a reported CVE (CVE-2025-66471)
02
urllib3 constrained to >=2.6.0
03
Affected packages moved from main to dev dependency group, limiting runtime exposure
04
No direct Krux source code changes
Evidence from the diff
The patch modifies pyproject.toml to add an explicit urllib3 = “>=2.6.0” constraint in the dev dependency group and regenerates poetry.lock, moving urllib3 from 2.5.0 to 2.6.0. Several related packages (requests, translate, libretranslatepy, lxml, certifi, charset-normalizer, idna, click) are also recategorized from main to dev groups because they are only needed for development/translation tooling. The commit message explicitly references CVE-2025-66471. No verified external references were supplied, so the exact nature of the CVE is taken from the commit message alone.
Changed components
pyproject.tomlpoetry.lockurllib3 dependencyrequests dependency (dev)translate dependency (dev)Inspect captured patch +23 / −17
diff --git a/poetry.lock b/poetry.lock
index dc953c8..b5ad10f 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -1,4 +1,4 @@
-# This file is automatically @generated by Poetry 2.1.1 and should not be changed by hand.
+# This file is automatically @generated by Poetry 2.2.1 and should not be changed by hand.
[[package]]
name = "astroid"
@@ -101,11 +101,12 @@ version = "2025.10.5"
description = "Python package for providing Mozilla's CA Bundle."
optional = false
python-versions = ">=3.7"
-groups = ["main"]
+groups = ["main", "dev"]
files = [
{file = "certifi-2025.10.5-py3-none-any.whl", hash = "sha256:0f212c2744a9bb6de0c56639a6f68afe01ecd92d91f14ae897c4fe7bbeeef0de"},
{file = "certifi-2025.10.5.tar.gz", hash = "sha256:47c09d31ccf2acf0be3f701ea53595ee7e0b8fa08801c6624be771df09ae7b43"},
]
+markers = {main = "extra == \"docs\""}
[[package]]
name = "charset-normalizer"
@@ -113,7 +114,7 @@ version = "3.4.4"
description = "The Real First Universal Charset Detector. Open, modern and actively maintained alternative to Chardet."
optional = false
python-versions = ">=3.7"
-groups = ["main"]
+groups = ["main", "dev"]
files = [
{file = "charset_normalizer-3.4.4-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:e824f1492727fa856dd6eda4f7cee25f8518a12f3c4a56a74e8095695089cf6d"},
{file = "charset_normalizer-3.4.4-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4bd5d4137d500351a30687c2d3971758aac9a19208fc110ccb9d7188fbe709e8"},
@@ -229,6 +230,7 @@ files = [
{file = "charset_normalizer-3.4.4-py3-none-any.whl", hash = "sha256:7a32c560861a02ff789ad905a2fe94e3f840803362c84fecf1851cb4cf3dc37f"},
{file = "charset_normalizer-3.4.4.tar.gz", hash = "sha256:94537985111c35f28720e43603b8e7b43a6ecfb2ce1d3058bbe955b73404e21a"},
]
+markers = {main = "extra == \"docs\""}
[[package]]
name = "click"
@@ -241,6 +243,7 @@ files = [
{file = "click-8.3.0-py3-none-any.whl", hash = "sha256:9b9f285302c6e3064f4330c05f05b81945b2a39544279343e6e7c5f27a9baddc"},
{file = "click-8.3.0.tar.gz", hash = "sha256:e7b8232224eba16f4ebe410c25ced9f7875cb5f3263ffc93cc3e8da705e229c4"},
]
+markers = {main = "extra == \"docs\""}
[package.dependencies]
colorama = {version = "*", markers = "platform_system == \"Windows\""}
@@ -256,7 +259,7 @@ files = [
{file = "colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"},
{file = "colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"},
]
-markers = {main = "platform_system == \"Windows\" or extra == \"docs\" or extra == \"sign\" and sys_platform == \"win32\"", dev = "platform_system == \"Windows\" or sys_platform == \"win32\""}
+markers = {main = "extra == \"sign\" and sys_platform == \"win32\" or extra == \"docs\"", dev = "platform_system == \"Windows\" or sys_platform == \"win32\""}
[[package]]
name = "coverage"
@@ -434,11 +437,12 @@ version = "3.11"
description = "Internationalized Domain Names in Applications (IDNA)"
optional = false
python-versions = ">=3.8"
-groups = ["main"]
+groups = ["main", "dev"]
files = [
{file = "idna-3.11-py3-none-any.whl", hash = "sha256:771a87f49d9defaf64091e6e6fe9c18d4833f140bd19464795bc32d966ca37ea"},
{file = "idna-3.11.tar.gz", hash = "sha256:795dafcc9c04ed0c1fb032c2aa73654d8e8c5023a7df64a53f39190ada629902"},
]
+markers = {main = "extra == \"docs\""}
[package.extras]
all = ["flake8 (>=7.1.1)", "mypy (>=1.11.2)", "pytest (>=8.3.2)", "ruff (>=0.6.2)"]
@@ -496,7 +500,7 @@ version = "2.1.1"
description = "Python bindings for LibreTranslate API"
optional = false
python-versions = "*"
-groups = ["main"]
+groups = ["dev"]
files = [
{file = "libretranslatepy-2.1.1-py3-none-any.whl", hash = "sha256:bf9f8b0003c94f34e141553b7ec0a02876297c06955f5efea49afbc9f85303a9"},
{file = "libretranslatepy-2.1.1.tar.gz", hash = "sha256:3f28e1b990ba5f514ae215c08ace0c4e2327eeccaa356983aefbca3a25ecc568"},
@@ -508,7 +512,7 @@ version = "6.0.2"
description = "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API."
optional = false
python-versions = ">=3.8"
-groups = ["main"]
+groups = ["dev"]
files = [
{file = "lxml-6.0.2-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:e77dd455b9a16bbd2a5036a63ddbd479c19572af81b624e79ef422f929eef388"},
{file = "lxml-6.0.2-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:5d444858b9f07cefff6455b983aea9a67f7462ba1f6cbe4a21e8bf6791bf2153"},
@@ -1741,11 +1745,12 @@ version = "2.32.5"
description = "Python HTTP for Humans."
optional = false
python-versions = ">=3.9"
-groups = ["main"]
+groups = ["main", "dev"]
files = [
{file = "requests-2.32.5-py3-none-any.whl", hash = "sha256:2462f94637a34fd532264295e186976db0f5d453d1cdd31473c85a6a161affb6"},
{file = "requests-2.32.5.tar.gz", hash = "sha256:dbba0bac56e100853db0ea71b82b4dfd5fe2bf6d3754a8893c3af500cec7d7cf"},
]
+markers = {main = "extra == \"docs\""}
[package.dependencies]
certifi = ">=2017.4.17"
@@ -1823,7 +1828,7 @@ version = "3.6.1"
description = "This is a simple, yet powerful command line translator with google translate behind it. You can also use it as a Python module in your code."
optional = false
python-versions = "*"
-groups = ["main"]
+groups = ["dev"]
files = [
{file = "translate-3.6.1-py2.py3-none-any.whl", hash = "sha256:cebfb004989d9a2ab0d24c0c5805783c7f4e07243ea4ed2a8f1809d072bf712b"},
{file = "translate-3.6.1.tar.gz", hash = "sha256:7e70ffa46f193cc744be7c88b8e1323f10f6b2bb90d24bb5d29fdf1e56618783"},
@@ -1851,21 +1856,21 @@ url = "vendor/foundation-ur-py"
[[package]]
name = "urllib3"
-version = "2.5.0"
+version = "2.6.0"
description = "HTTP library with thread-safe connection pooling, file post, and more."
optional = false
python-versions = ">=3.9"
-groups = ["main"]
+groups = ["main", "dev"]
files = [
- {file = "urllib3-2.5.0-py3-none-any.whl", hash = "sha256:e6b01673c0fa6a13e374b50871808eb3bf7046c4b125b216f6bf1cc604cff0dc"},
- {file = "urllib3-2.5.0.tar.gz", hash = "sha256:3fc47733c7e419d4bc3f6b3dc2b4f890bb743906a30d56ba4a5bfa4bbff92760"},
+ {file = "urllib3-2.6.0-py3-none-any.whl", hash = "sha256:c90f7a39f716c572c4e3e58509581ebd83f9b59cced005b7db7ad2d22b0db99f"},
+ {file = "urllib3-2.6.0.tar.gz", hash = "sha256:cb9bcef5a4b345d5da5d145dc3e30834f58e8018828cbc724d30b4cb7d4d49f1"},
]
[package.extras]
-brotli = ["brotli (>=1.0.9) ; platform_python_implementation == \"CPython\"", "brotlicffi (>=0.8.0) ; platform_python_implementation != \"CPython\""]
+brotli = ["brotli (>=1.2.0) ; platform_python_implementation == \"CPython\"", "brotlicffi (>=1.2.0.0) ; platform_python_implementation != \"CPython\""]
h2 = ["h2 (>=4,<5)"]
socks = ["pysocks (>=1.5.6,!=1.5.7,<2.0)"]
-zstd = ["zstandard (>=0.18.0)"]
+zstd = ["backports-zstd (>=1.0.0) ; python_version < \"3.14\""]
[[package]]
name = "urtypes"
@@ -1946,4 +1951,4 @@ simulator = ["Pillow", "numpy", "opencv-python", "pygame", "pyzbar"]
[metadata]
lock-version = "2.1"
python-versions = "^3.12.3"
-content-hash = "c5d0eed771abce5ddb72522617d2d837317555aa5778055d9b95defd65166dcf"
+content-hash = "d319ebfb89e5004ea71447cc0c5bc8cf3a9298294c80c60ed1b1c3dc168b4bb9"
diff --git a/pyproject.toml b/pyproject.toml
index 5281f55..ff64348 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -30,7 +30,6 @@ license = "MIT"
[tool.poetry.dependencies]
python = "^3.12.3"
-translate = "^3.6.1"
embit = { path = "./vendor/embit/", develop = true }
ur = { path = "./vendor/foundation-ur-py/", develop = true }
urtypes = { path = "./vendor/urtypes/", develop = true }
@@ -65,6 +64,8 @@ PyQRCode = "^1.2.1"
pycryptodome = "^3.23.0"
poethepoet = "^0.37.0"
vulture = "^2.14"
+translate = "^3.6.1"
+urllib3 = ">=2.6.0"
[tool.poetry.extras]
docs = ["mkdocs", "mkdocs-material", "mkdocs-static-i18n", "pymdown-extensions", "mkdocs-macros-plugin"]
Risk score
Our methodology →Why this scored 36/100
Human-validated context
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
No validated notes yet.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.