{Packaging} bump paramiko version - #33946
Conversation
|
Hi mansoor sarfraz (@msarfraz), |
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
microsoft-github-policy-service
Bot
added
Auto-Assign
There was a problem hiding this comment.
Pull request overview
This PR updates Azure CLI packaging metadata to allow/pin Paramiko 5.x in order to unblock remediation for a Paramiko CVE and ensure Azure CLI can be installed alongside Paramiko >= 5.
Changes:
- Relaxed the Paramiko upper-bound in
setup.pyto permit 5.x. - Pinned Paramiko to 5.0.0 in the platform-specific Python 3 requirements files (Windows/Linux/macOS).
- Updated
NOTICE.txtto reflect Paramiko 5.0.0.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| src/azure-cli/setup.py | Adjusts Paramiko version constraint for install_requires. |
| src/azure-cli/requirements.py3.windows.txt | Pins Paramiko to 5.0.0 for Windows builds. |
| src/azure-cli/requirements.py3.Linux.txt | Pins Paramiko to 5.0.0 for Linux builds. |
| src/azure-cli/requirements.py3.Darwin.txt | Pins Paramiko to 5.0.0 for macOS builds. |
| NOTICE.txt | Updates third-party notice entry to Paramiko 5.0.0. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| 'jsondiff~=2.0.0', | ||
| 'packaging>=20.9', | ||
| 'paramiko>=2.0.8,<4.0.0', | ||
| 'paramiko>=2.0.8,<6.0.0', |
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
Cooper Cox (coopercox-ms)
added
the
Azure Client Tools Agent Requested
Live test skipped⏭️ Skipping the live test for this revision because no changed test file was found ( The live-test pipeline runs only the test files a PR changes, so there is nothing to execute for this commit. A skipped live test is not a passing test result. The Agent review separately checks whether the affected command module includes focused regression tests or updated recordings. If a test file is changed in a later commit, the live test will run automatically. |
![azure-client-tools-agent[bot]](https://avatars.githubusercontent.com/in/4205534?s=60&v=4){kind=small}
There was a problem hiding this comment.
All Checks Passed ✅
All CI checks passed and no live test failures were detected for this PR.
| Check | Result |
|---|---|
| CI pipeline | ✅ All checks passed |
| Live test | ⏭️ Skipped (no changed test files) |
| Regression coverage | ✅ No gap detected |
This PR ({Packaging} bump paramiko version) is ready for human review and merge.
azure-client-tools-agent
Bot
added
azure-client-tools-agent
|
🔔 Routing this PR to @Azure/act-platform-engineering-squad. |
🤖 PR Validation — ️✔️ All clear
Background
azure-cli declares a dependency of paramiko<4.0.0,>=2.0.8. GHSA-r374-rxx8-8654 (CWE-327) affects all paramiko releases through 4.0.0 — the fix is exclusively in paramiko 5.0.0, which removes SHA-1 RSA signature support. Because azure-cli caps its dependency below 4.0.0, any project that depends on azure-cli cannot resolve paramiko 5.0.0, leaving consumers with no available pip-compatible remediation path for this CVE.
Solution
Bump paramiko versin to 5.0.0 to resolve CVE-2026-44405 and allow paramiko dependency >= 5
Expected behavior
Installing azure-cli alongside paramiko>=5.0.0 resolves successfully