| FazBrowse GitHub Viewer | Trending | | Home |
| Tools: [Download Repo ZIP] [Original HTTPS Page] |
|
Thanks for raising this PR. I can review this. |
Sorry, something went wrong.
There was a problem hiding this comment.
This PR replaces the ecdsa library with the cryptography library for handling ECDSA signature verification in the SendGrid Python SDK. This change affects the event webhook functionality that validates incoming webhook signatures from SendGrid.
Key changes:
Copilot reviewed 5 out of 6 changed files in this pull request and generated 3 comments.
Show a summary per file| File | Description |
|---|---|
| setup.py | Replaces ecdsa dependency with cryptography>=45.0.6 |
| sendgrid/helpers/eventwebhook/init.py | Updates signature verification implementation to use cryptography library |
| README.rst | Updates dependency documentation reference |
| README.md | Updates dependency documentation reference |
| CONTRIBUTING.md | Updates development dependency reference |
Sorry, something went wrong.
|
I see the verify signature test is passing. So it seems to be fine. Can you please do the above mentioned changes so that we can merge it? Thanks! |
Sorry, something went wrong.
|
Hey @tiwarishubham635 , is there anything pending to merge this? One would expect security fixes to be a high priority for Twilio... |
Sorry, something went wrong.
|
@tiwarishubham635 @twilio-product-security Hi, is there anything I can do to help speed up merging this security fix? Kind regards, |
Sorry, something went wrong.
|
Hi, any update on this PR? Thanks! |
Sorry, something went wrong.
There was a problem hiding this comment.
This PR successfully addresses the security vulnerabilities in the ecdsa dependency by migrating to the industry-standard cryptography library. The implementation is clean and maintains backward compatibility.
Minor Suggestion:
Version Constraint: Consider if cryptography>=45.0.6 is too restrictive - you might want to allow a broader range like >=45.0.6,<46 to avoid forcing users to upgrade to very recent versions.
Sorry, something went wrong.
|
This is a breaking change as it adds a new client requirement for a Rust toolchain that never existed before. Please can such things be put behind a Major version change, this broke our build as we now have to explicitly mark this "patch" version as incompatible. |
Sorry, something went wrong.
| Back | FazBrowse Home | New Git URL |
Fixes #1108
Fixes
A short description of what this PR does.
Checklist
If you have questions, please file a support ticket.