Fix/sumo 281751 vulnerability fix#99

Open

piyushgupta-sumo wants to merge 15 commits intomainfrom

fix/SUMO-281751-vulnerability-fix

Commits on Apr 29, 2026

SUMO-281751: python version updated to 3.14
Piyush Gupta
committed
SUMO-281751: fix for Certifi removes GLOBALTRUST root certificate
Piyush Gupta
committed
SUMO-281751: fix for setuptools vulnerable to Command Injection via package URL High
Piyush Gupta
committed
SUMO-281751: fix for urllib3 allows an unbounded number of links in the decompression chain
Piyush Gupta
committed
SUMO-281751: fix for Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)
Piyush Gupta
committed
SUMO-281751: fix for Black: Arbitrary file writes from unsanitized user input in cache file name
Piyush Gupta
committed
SUMO-281751: fix for virtualenv allows command injection through activation scripts for a virtual environment
Piyush Gupta
committed
SUMO-281751: fix for setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write
Piyush Gupta
committed
SUMO-281751: fix for zipp Denial of Service vulnerability
Piyush Gupta
committed

Commits on Apr 30, 2026

SUMO-281751: fix for filelock has a TOCTOU race condition which allows symlink attacks during lock file creation
Piyush Gupta
committed
SUMO-281751: fix for filelock has a TOCTOU race condition which allows symlink attacks during lock file creation
Piyush Gupta
committed
SUMO-281751: bump virtualenv to >=21.3.0, add pygments, regenerate lock
Piyush Gupta
committed
SUMO-281751: change log updated for vulnerabilities
Piyush Gupta
committed
SUMO-281751: change log updated for vulnerabilities
Piyush Gupta
committed
SUMO-281751: resolved copilot commits
Piyush Gupta
committed