Require grpcio>=1.84.1 (bundled roots trust the compromised eMudhra CAs)

.github/scripts/envgen.py

@@ -12,6 +12,9 @@
                          because databricks-connect (installed from the dev group)
                          governs their versions and can require outside the runtime's
                          patch line. See ``req`` (CONNECT_GOVERNED) / issues #16,#19,#20.
+  * Security floors    - a package whose runtime version is below its minimum safe
+                         version is pinned to ``>=FLOOR,<NEXT_MAJOR`` instead. See
+                         SECURITY_FLOOR.
   * databricks-connect - pinned to ``~=MAJOR.MINOR.0`` and emitted into
                          ``[dependency-groups].dev`` of the pyproject (installed by
                          default under uv); omitted from constraints.txt so the pip
@@ -95,6 +98,23 @@
 # metadata (and wheel availability) picks the version in-range. See req() / issue #16.
 CONNECT_GOVERNED = {"databricks-sdk", "grpcio", "grpcio-status"}
 
+# Minimum versions required for security, whatever the runtime lists. A runtime
+# version below the floor is pinned to ``>=FLOOR,<NEXT_MAJOR`` (the upper bound ~=
+# would give); at or above the floor the normal pin is kept.
+#
+# grpcio 1.84.1 requires Python >= 3.10. No Python 3.9 environment pins grpcio today.
+SECURITY_FLOOR = {"grpcio": "1.84.1"}
+
+# Floors that a SECURITY_FLOOR release itself requires, so runtimes listing an older
+# version stay resolvable. grpcio 1.84.1 requires typing-extensions~=4.12, and DBR
+# 13.3 to 16.4 and serverless-v1 to v3 list typing-extensions 4.3 to 4.11.
+FLOOR_DEPENDENCIES = {"typing-extensions": "4.12"}
+
+
+def _release(version):
+    """Leading numeric release of a version, as a tuple of ints ('1.84.1rc1' -> (1, 84, 1))."""
+    return tuple(int(p) for p in re.match(r"\d+(?:\.\d+)*", version).group(0).split("."))
+
 
 def norm(name):
     # Strip the '*' footnote marker the release-notes tables append to some package
@@ -125,8 +145,15 @@ def req(name, version):
     wheel). Widening to ``MAJOR.MINOR`` (``~=0.67`` → ``>=0.67,<1``) keeps the runtime's
     version as the floor while letting databricks-connect's metadata and wheel
     availability pick the exact version in-range. See issues #16, #19, #20.
+
+    A package in ``SECURITY_FLOOR`` or ``FLOOR_DEPENDENCIES`` whose version is below
+    its floor is rendered as ``>=FLOOR,<NEXT_MAJOR`` (``grpcio 1.60.0`` ->
+    ``grpcio>=1.84.1,<2``, ``typing-extensions 4.4.0`` -> ``typing-extensions>=4.12,<5``).
     """
     version = version.split("+", 1)[0]
+    floor = SECURITY_FLOOR.get(name) or FLOOR_DEPENDENCIES.get(name)
+    if floor and _release(version) < _release(floor):
+        return f"{name}>={floor},<{_release(floor)[0] + 1}"
     if name in CONNECT_GOVERNED:
         version = ".".join(version.split(".")[:2])
     return f"{name}~={version}"

.github/scripts/test_envgen.py

@@ -95,9 +95,42 @@ def test_grpc_family_widened_to_major_minor(self):
         # grpcio / grpcio-status move with databricks-connect (installed from the dev
         # group), which can require a version outside the runtime's patch line — so
         # widen them to MAJOR.MINOR like databricks-sdk, keeping the runtime as floor.
-        self.assertEqual(req("grpcio", "1.48.2"), "grpcio~=1.48")
+        # (grpcio below its security floor is covered by SecurityFloorTest.)
+        self.assertEqual(req("grpcio", "1.85.0"), "grpcio~=1.85")
         self.assertEqual(req("grpcio-status", "1.48.1"), "grpcio-status~=1.48")
-        self.assertEqual(req("grpcio", "1.67.0"), "grpcio~=1.67")
+        self.assertEqual(req("grpcio-status", "1.67.0"), "grpcio-status~=1.67")
+
+
+class SecurityFloorTest(unittest.TestCase):
+    def test_grpcio_below_floor_raised(self):
+        # Every runtime listing grpcio below 1.84.1 gets the floor, with the <2 bound
+        # that ~= would give.
+        for v in ("1.48.2", "1.60.0", "1.67.0", "1.76.0", "1.84.0", "1.84.0+db1"):
+            self.assertEqual(req("grpcio", v), "grpcio>=1.84.1,<2", v)
+
+    def test_grpcio_at_or_above_floor_unchanged(self):
+        self.assertEqual(req("grpcio", "1.84.1"), "grpcio~=1.84")
+        self.assertEqual(req("grpcio", "1.85.0"), "grpcio~=1.85")
+
+    def test_grpcio_status_not_floored(self):
+        # grpcio-status has no floor. Raising it would pull a newer protobuf than the
+        # runtime pins, and grpcio-status 1.x already accepts a newer grpcio.
+        self.assertEqual(req("grpcio-status", "1.60.0"), "grpcio-status~=1.60")
+
+    def test_typing_extensions_raised_for_grpcio(self):
+        # grpcio 1.84.1 requires typing-extensions~=4.12, so older runtime pins would
+        # make the floored grpcio unresolvable.
+        self.assertEqual(req("typing-extensions", "4.4.0"), "typing-extensions>=4.12,<5")
+        self.assertEqual(req("typing-extensions", "4.11.0"), "typing-extensions>=4.12,<5")
+        self.assertEqual(req("typing-extensions", "4.12.2"), "typing-extensions~=4.12.2")
+
+    def test_floor_reaches_both_artifacts(self):
+        pkgs = {"grpcio": "1.67.0", "grpcio-status": "1.67.0"}
+        for out in (build_pyproject(pkgs, "serverless-v4", "3.12.3"),
+                    build_constraints(pkgs, "serverless-v4")):
+            self.assertIn("grpcio>=1.84.1,<2", out)
+            self.assertIn("grpcio-status~=1.67", out)
+            self.assertNotIn("grpcio~=", out)
 
 
 class BuildArtifactsTest(unittest.TestCase):

python/dbr/12.2.x-scala2.12/constraints.txt

@@ -112,7 +112,7 @@ tokenize-rt~=4.2.1
 tomli~=1.2.2
 tornado~=6.1
 traitlets~=5.1.1
-typing-extensions~=4.1.1
+typing-extensions>=4.12,<5
 ujson~=5.1.0
 urllib3~=1.26.9
 virtualenv~=20.8.0

python/dbr/12.2.x-scala2.12/pyproject.toml

@@ -124,7 +124,7 @@ constraint-dependencies = [
     "tomli~=1.2.2",
     "tornado~=6.1",
     "traitlets~=5.1.1",
-    "typing-extensions~=4.1.1",
+    "typing-extensions>=4.12,<5",
     "ujson~=5.1.0",
     "urllib3~=1.26.9",
     "virtualenv~=20.8.0",

python/dbr/13.3.x-cpu-ml-scala2.12/constraints.txt

@@ -87,7 +87,7 @@ google-pasta~=0.2.0
 google-resumable-media~=2.5.0
 googleapis-common-protos~=1.56.4
 greenlet~=1.1.1
-grpcio~=1.48
+grpcio>=1.84.1,<2
 grpcio-status~=1.48
 gunicorn~=20.1.0
 gviz-api~=1.10.0
@@ -282,7 +282,7 @@ tqdm~=4.64.1
 traitlets~=5.1.1
 transformers~=4.30.2
 typer~=0.7.0
-typing-extensions~=4.3.0
+typing-extensions>=4.12,<5
 typing-inspect~=0.9.0
 ujson~=5.4.0
 urllib3~=1.26.11

python/dbr/13.3.x-cpu-ml-scala2.12/pyproject.toml

@@ -99,7 +99,7 @@ constraint-dependencies = [
     "google-resumable-media~=2.5.0",
     "googleapis-common-protos~=1.56.4",
     "greenlet~=1.1.1",
-    "grpcio~=1.48",
+    "grpcio>=1.84.1,<2",
     "grpcio-status~=1.48",
     "gunicorn~=20.1.0",
     "gviz-api~=1.10.0",
@@ -294,7 +294,7 @@ constraint-dependencies = [
     "traitlets~=5.1.1",
     "transformers~=4.30.2",
     "typer~=0.7.0",
-    "typing-extensions~=4.3.0",
+    "typing-extensions>=4.12,<5",
     "typing-inspect~=0.9.0",
     "ujson~=5.4.0",
     "urllib3~=1.26.11",

python/dbr/13.3.x-gpu-ml-scala2.12/constraints.txt

@@ -88,7 +88,7 @@ google-pasta~=0.2.0
 google-resumable-media~=2.5.0
 googleapis-common-protos~=1.56.4
 greenlet~=1.1.1
-grpcio~=1.48
+grpcio>=1.84.1,<2
 grpcio-status~=1.48
 gunicorn~=20.1.0
 gviz-api~=1.10.0
@@ -282,7 +282,7 @@ tqdm~=4.64.1
 traitlets~=5.1.1
 transformers~=4.30.2
 typer~=0.7.0
-typing-extensions~=4.3.0
+typing-extensions>=4.12,<5
 typing-inspect~=0.9.0
 ujson~=5.4.0
 urllib3~=1.26.11

python/dbr/13.3.x-gpu-ml-scala2.12/pyproject.toml

@@ -100,7 +100,7 @@ constraint-dependencies = [
     "google-resumable-media~=2.5.0",
     "googleapis-common-protos~=1.56.4",
     "greenlet~=1.1.1",
-    "grpcio~=1.48",
+    "grpcio>=1.84.1,<2",
     "grpcio-status~=1.48",
     "gunicorn~=20.1.0",
     "gviz-api~=1.10.0",
@@ -294,7 +294,7 @@ constraint-dependencies = [
     "traitlets~=5.1.1",
     "transformers~=4.30.2",
     "typer~=0.7.0",
-    "typing-extensions~=4.3.0",
+    "typing-extensions>=4.12,<5",
     "typing-inspect~=0.9.0",
     "ujson~=5.4.0",
     "urllib3~=1.26.11",

python/dbr/13.3.x-scala2.12/constraints.txt

@@ -33,7 +33,7 @@ fastjsonschema~=2.18.0
 filelock~=3.12.2
 fonttools~=4.25.0
 googleapis-common-protos~=1.56.4
-grpcio~=1.48
+grpcio>=1.84.1,<2
 grpcio-status~=1.48
 httplib2~=0.20.2
 idna~=3.3
@@ -128,7 +128,7 @@ tokenize-rt~=4.2.1
 tomli~=2.0.1
 tornado~=6.1
 traitlets~=5.1.1
-typing-extensions~=4.3.0
+typing-extensions>=4.12,<5
 ujson~=5.4.0
 urllib3~=1.26.11
 virtualenv~=20.16.3

python/dbr/13.3.x-scala2.12/pyproject.toml

@@ -45,7 +45,7 @@ constraint-dependencies = [
     "filelock~=3.12.2",
     "fonttools~=4.25.0",
     "googleapis-common-protos~=1.56.4",
-    "grpcio~=1.48",
+    "grpcio>=1.84.1,<2",
     "grpcio-status~=1.48",
     "httplib2~=0.20.2",
     "idna~=3.3",
@@ -140,7 +140,7 @@ constraint-dependencies = [
     "tomli~=2.0.1",
     "tornado~=6.1",
     "traitlets~=5.1.1",
-    "typing-extensions~=4.3.0",
+    "typing-extensions>=4.12,<5",
     "ujson~=5.4.0",
     "urllib3~=1.26.11",
     "virtualenv~=20.16.3",

python/dbr/14.3.x-cpu-ml-scala2.12/constraints.txt

@@ -87,7 +87,7 @@ google-pasta~=0.2.0
 google-resumable-media~=2.7.0
 googleapis-common-protos~=1.62.0
 greenlet~=2.0.1
-grpcio~=1.48
+grpcio>=1.84.1,<2
 grpcio-status~=1.48
 gunicorn~=20.1.0
 gviz-api~=1.10.0
@@ -285,7 +285,7 @@ tqdm~=4.64.1
 traitlets~=5.7.1
 transformers~=4.36.1
 typer~=0.9.0
-typing-extensions~=4.4.0
+typing-extensions>=4.12,<5
 typing-inspect~=0.9.0
 ujson~=5.4.0
 urllib3~=1.26.14

python/dbr/14.3.x-cpu-ml-scala2.12/pyproject.toml

@@ -99,7 +99,7 @@ constraint-dependencies = [
     "google-resumable-media~=2.7.0",
     "googleapis-common-protos~=1.62.0",
     "greenlet~=2.0.1",
-    "grpcio~=1.48",
+    "grpcio>=1.84.1,<2",
     "grpcio-status~=1.48",
     "gunicorn~=20.1.0",
     "gviz-api~=1.10.0",
@@ -297,7 +297,7 @@ constraint-dependencies = [
     "traitlets~=5.7.1",
     "transformers~=4.36.1",
     "typer~=0.9.0",
-    "typing-extensions~=4.4.0",
+    "typing-extensions>=4.12,<5",
     "typing-inspect~=0.9.0",
     "ujson~=5.4.0",
     "urllib3~=1.26.14",

python/dbr/14.3.x-gpu-ml-scala2.12/constraints.txt

@@ -89,7 +89,7 @@ google-pasta~=0.2.0
 google-resumable-media~=2.7.0
 googleapis-common-protos~=1.62.0
 greenlet~=2.0.1
-grpcio~=1.48
+grpcio>=1.84.1,<2
 grpcio-status~=1.48
 gunicorn~=20.1.0
 gviz-api~=1.10.0
@@ -287,7 +287,7 @@ tqdm~=4.64.1
 traitlets~=5.7.1
 transformers~=4.36.1
 typer~=0.9.0
-typing-extensions~=4.4.0
+typing-extensions>=4.12,<5
 typing-inspect~=0.9.0
 ujson~=5.4.0
 urllib3~=1.26.14

python/dbr/14.3.x-gpu-ml-scala2.12/pyproject.toml

@@ -101,7 +101,7 @@ constraint-dependencies = [
     "google-resumable-media~=2.7.0",
     "googleapis-common-protos~=1.62.0",
     "greenlet~=2.0.1",
-    "grpcio~=1.48",
+    "grpcio>=1.84.1,<2",
     "grpcio-status~=1.48",
     "gunicorn~=20.1.0",
     "gviz-api~=1.10.0",
@@ -299,7 +299,7 @@ constraint-dependencies = [
     "traitlets~=5.7.1",
     "transformers~=4.36.1",
     "typer~=0.9.0",
-    "typing-extensions~=4.4.0",
+    "typing-extensions>=4.12,<5",
     "typing-inspect~=0.9.0",
     "ujson~=5.4.0",
     "urllib3~=1.26.14",

python/dbr/14.3.x-scala2.12/constraints.txt

@@ -35,7 +35,7 @@ fastjsonschema~=2.19.1
 filelock~=3.13.1
 fonttools~=4.25.0
 googleapis-common-protos~=1.62.0
-grpcio~=1.48
+grpcio>=1.84.1,<2
 grpcio-status~=1.48
 httplib2~=0.20.2
 idna~=3.4
@@ -136,7 +136,7 @@ tokenize-rt~=4.2.1
 tomli~=2.0.1
 tornado~=6.1
 traitlets~=5.7.1
-typing-extensions~=4.4.0
+typing-extensions>=4.12,<5
 ujson~=5.4.0
 urllib3~=1.26.14
 virtualenv~=20.16.7

python/dbr/14.3.x-scala2.12/pyproject.toml

@@ -47,7 +47,7 @@ constraint-dependencies = [
     "filelock~=3.13.1",
     "fonttools~=4.25.0",
     "googleapis-common-protos~=1.62.0",
-    "grpcio~=1.48",
+    "grpcio>=1.84.1,<2",
     "grpcio-status~=1.48",
     "httplib2~=0.20.2",
     "idna~=3.4",
@@ -148,7 +148,7 @@ constraint-dependencies = [
     "tomli~=2.0.1",
     "tornado~=6.1",
     "traitlets~=5.7.1",
-    "typing-extensions~=4.4.0",
+    "typing-extensions>=4.12,<5",
     "ujson~=5.4.0",
     "urllib3~=1.26.14",
     "virtualenv~=20.16.7",

python/dbr/15.4.x-cpu-ml-scala2.12/constraints.txt

@@ -92,7 +92,7 @@ google-pasta~=0.2.0
 google-resumable-media~=2.7.1
 googleapis-common-protos~=1.63.0
 greenlet~=2.0.1
-grpcio~=1.60
+grpcio>=1.84.1,<2
 grpcio-status~=1.60
 gunicorn~=20.1.0
 gviz-api~=1.10.0
@@ -321,7 +321,7 @@ tqdm~=4.65.0
 traitlets~=5.7.1
 transformers~=4.41.2
 typer~=0.9.4
-typing-extensions~=4.10.0
+typing-extensions>=4.12,<5
 typing-inspect~=0.9.0
 tzdata~=2022.1
 uc-micro-py~=1.0.1

python/dbr/15.4.x-cpu-ml-scala2.12/pyproject.toml

@@ -104,7 +104,7 @@ constraint-dependencies = [
     "google-resumable-media~=2.7.1",
     "googleapis-common-protos~=1.63.0",
     "greenlet~=2.0.1",
-    "grpcio~=1.60",
+    "grpcio>=1.84.1,<2",
     "grpcio-status~=1.60",
     "gunicorn~=20.1.0",
     "gviz-api~=1.10.0",
@@ -333,7 +333,7 @@ constraint-dependencies = [
     "traitlets~=5.7.1",
     "transformers~=4.41.2",
     "typer~=0.9.4",
-    "typing-extensions~=4.10.0",
+    "typing-extensions>=4.12,<5",
     "typing-inspect~=0.9.0",
     "tzdata~=2022.1",
     "uc-micro-py~=1.0.1",

python/dbr/15.4.x-gpu-ml-scala2.12/constraints.txt

@@ -93,7 +93,7 @@ google-pasta~=0.2.0
 google-resumable-media~=2.7.1
 googleapis-common-protos~=1.63.0
 greenlet~=2.0.1
-grpcio~=1.60
+grpcio>=1.84.1,<2
 grpcio-status~=1.60
 gunicorn~=20.1.0
 gviz-api~=1.10.0
@@ -322,7 +322,7 @@ tqdm~=4.65.0
 traitlets~=5.7.1
 transformers~=4.41.2
 typer~=0.9.4
-typing-extensions~=4.10.0
+typing-extensions>=4.12,<5
 typing-inspect~=0.9.0
 tzdata~=2022.1
 uc-micro-py~=1.0.1