[python] bump generated client dependency floors above vulnerable ranges
Bumps the dependency floors declared in the python client generator's manifest templates so that generated clients no longer declare version ranges that intersect known-vulnerable releases — while keeping them installable under the generator's declared requires-python = ">=3.9".
Problem
The python generator's manifest templates pin open-ended floors that were chosen as minimum-compatible, not CVE-safe, and have not moved in a long time:
| package | previous floor | kind |
|---|---|---|
urllib3 | >= 2.1.0, < 3.0.0 | runtime |
aiohttp | >= 3.8.4 | runtime (asyncio) |
pytest | >= 7.2.1 | dev |
Because generated clients are libraries with no lockfile, the dependency graph records the declared range. Vulnerability scanners (Dependabot, pip-audit, etc.) flag any range that intersects a vulnerable range — so every generated client trips security alerts for its downstream consumers even when the resolved/installed version is safe.
Change
Raise the floors to the highest releases still published for Python 3.9 (the generator's declared minimum), keeping the existing urllib3 < 3.0.0 cap:
| package | new floor | notes |
|---|---|---|
urllib3 | >= 2.6.3, < 3.0.0 | last 2.6.x; urllib3 2.7.0 requires Python >=3.10 |
aiohttp | >= 3.13.5 | last 3.13.x; aiohttp 3.14.0 requires Python >=3.10 |
pytest | >= 8.4.2 | last 8.x; pytest 9.0.0 requires Python >=3.10 (dev-only) |
These clear the older and high-severity advisories the previous ranges intersected (e.g. urllib3 issues fixed through 2.6.3, the aiohttp advisories fixed through 3.13.x including the high-severity ones, and pytest issues below 8.4.2).
Why not the very latest patched releases?
The most recent fixes ship only in releases that require Python >=3.10:
- urllib3 GHSA-mf9v-mfxr-j63j / CVE-2026-44432 and GHSA-qccp-gfcp-xxvc / CVE-2026-44431 — fixed in
2.7.0 - the aiohttp
<= 3.14.0advisory batch — fixed in3.14.1 - pytest GHSA-6w46-j5rx-g56g / CVE-2025-71176 (dev-only) — fixed in
9.0.3
Pinning those as floors would make the generated clients uninstallable on Python 3.9, which the generator still declares as its minimum. Fully clearing them at the declaration level would require raising requires-python to >=3.10 — a breaking change that is a maintainer decision, out of scope here. Since the floors are open-ended upward, consumers on Python >=3.10 still resolve to those fully-patched releases naturally.
Touched templates (floor lines only, no structural change):
modules/openapi-generator/src/main/resources/python/pyproject.mustachemodules/openapi-generator/src/main/resources/python/requirements.mustachemodules/openapi-generator/src/main/resources/python/setup.mustachemodules/openapi-generator/src/main/resources/python/test-requirements.mustache
Regenerated python samples are included.
PR checklist
- Read the contribution guidelines.
- Ran the build and regenerated the affected samples (
./bin/generate-samples.sh ./bin/configs/python*); committed all changed files. - This change targets the
pythongenerator; @mention of the technical committee left to maintainers.