Pin the dependencies in requirements.txt to the exact package versions currently used by: mainnet1.7.0-beta

[ping-ke]

Summary

Pin the dependencies in requirements.txt to the exact package versions currently used by: quarkchaindocker/pyquarkchain:mainnet1.7.0-beta

Motivation

The previous version ranges allowed dependency resolution to change over time, which could produce an environment different from the tested mainnet Docker image.

Using the package versions from mainnet1.7.0-beta provides:

• A reproducible Python environment
• Dependency versions already exercised by the existing Docker image tests
• A stable baseline for reviewing and testing the Python 3.13 compatibility changes
• Reduced risk from unreviewed dependency upgrades

Changes

• Replaced dependency version ranges in requirements.txt with exact versions from the running mainnet1.7.0-beta container.
• Kept pyethash pinned to commit: 907b7d8064d3be09536e754bbf469b442f2e213d
• No application or consensus logic was changed.

Dependency Version and Security Review

Most dependencies are pinned to the versions installed in the mainnet1.7.0-beta image.
The following packages were reviewed separately because they were either upgraded for security fixes
or retained after confirming that the reported vulnerabilities have no reachable attack path in pyquarkchain.

Package	mainnet1.7.0-beta	This PR	Decision and rationale
setuptools	82.0.1	83.0.0	Upgraded to the patched version for GHSA-h35f-9h28-mq5c / CVE-2026-59890. The issue concerns Unicode normalization collisions bypassing MANIFEST.in exclusions when building an sdist on macOS. The current deployment flow is not exposed, but upgrading the build/install tooling is low risk and prevents accidental inclusion of excluded files in future source distributions. setuptools is used by setup.py; it is not used to compile ethash or qkchash.
aiohttp	3.14.1	3.14.3	Upgraded because 3.14.1 is affected by known security advisories, including PYSEC-2026-3545 / CVE-2026-69244. 3.14.3 contains the corresponding upstream security fixes. The upgrade exposed a test-only port-reuse race, which is addressed by the get_next_port() helper change described below.
cryptography	46.0.7	46.0.7	Kept unchanged. The reviewed advisories affect X.509 chain verification, wildcard DNS constraint verification, PKCS#7/S/MIME decryption, or specific bundled OpenSSL APIs. pyquarkchain uses cryptography for secp256k1 ECDH, AES-CTR/ECB, HMAC, and constant-time comparison, and does not expose the affected certificate, PKCS#7/S/MIME, CMS, QUIC, OCSP/CMP, DHX, or AES-OCB/SIV paths. No reachable attack path was identified in the current code.
ecdsa	0.19.2	0.19.2	Kept unchanged. Version 0.19.2 already fixes the malformed-DER private-key parsing issue described by GHSA-9f5j-8jwj-x28g. The unfixed Minerva advisory (GHSA-wj6h-64fc-37mp) concerns P-256 timing behavior, while pyquarkchain uses SECP256k1 and does not use the affected sign_digest() path. No additional version upgrade is available or required for the current usage.

Test fix for aiohttp upgrade from 3.14.1 to 3.14.3.

The upgrade changes the timing of asynchronous connection cleanup and cancellation. As a result, an existing test race is exposed: an old P2P connection may still send its HELLO packet after the port is released and reused by a Cluster RPC server, causing KeyError: 0.

The previous version usually passed because the old connection was closed before the port was reused. The test helper now prevents port reuse within the same pytest process. No production code changes are required.

Verification

The following verification has been completed:

• Built and pushed quarkchaindocker/pyquarkchain:mainnet1.7.0-gamma with the updated requirements.txt.
• Started a node using the mainnet1.7.0-gamma image and confirmed that it runs and synchronizes with the network.

Reviewer Verification

Reviewers can independently verify the change with the following steps:

1. Start a container using quarkchaindocker/pyquarkchain:mainnet1.7.0-beta, inspect its installed package versions, and confirm that the direct dependencies match the versions pinned in requirements.txt.

   docker run --rm \
     quarkchaindocker/pyquarkchain:mainnet1.7.0-beta \
     python -m pip freeze --all

2. Start a node using quarkchaindocker/pyquarkchain:mainnet1.7.0-gamma and confirm that it starts successfully, connects to peers, and continues synchronizing blocks without dependency or runtime errors.

[qzhodl]

Audit results from pip-audit:

    {
      "name": "ecdsa",
      "version": "0.19.2",
      "vulns": [
        {
          "id": "PYSEC-2026-1325",
          "fix_versions": [],
          "aliases": [
            "CVE-2024-23342",
            "GHSA-wj6h-64fc-37mp"
          ]
        }
      ]
    }

    {
      "name": "setuptools",
      "version": "82.0.1",
      "vulns": [
        {
          "id": "PYSEC-2026-3447",
          "fix_versions": [
            "83.0.0"
          ],
          "aliases": [
            "BIT-setuptools-2026-59890",
            "CVE-2026-59890",
            "GHSA-h35f-9h28-mq5c"
          ]
        },
        {
          "id": "PYSEC-2026-3447",
          "fix_versions": [
            "83.0.0"
          ],
          "aliases": [
            "BIT-setuptools-2026-59890",
            "CVE-2026-59890",
            "GHSA-h35f-9h28-mq5c"
          ]
        }
      ]
    }

    {
      "name": "cryptography",
      "version": "46.0.7",
      "vulns": [
        {
          "id": "PYSEC-2026-3552",
          "fix_versions": [
            "50.0.0"
          ],
          "aliases": [
            "CVE-2026-69247",
            "GHSA-g6cj-pr64-35w5"
          ]
        },
        {
          "id": "PYSEC-2026-3553",
          "fix_versions": [
            "49.0.0"
          ],
          "aliases": [
            "CVE-2026-69249",
            "GHSA-jwv3-5hgf-82ww"
          ]
        },
        {
          "id": "PYSEC-2026-3554",
          "fix_versions": [
            "49.0.0"
          ],
          "aliases": [
            "GHSA-m2h6-j472-rp4c",
            "CVE-2026-69248"
          ]
        },
        {
          "id": "GHSA-537c-gmf6-5ccf",
          "fix_versions": [
            "48.0.1"
          ],
          "aliases": []
        }
      ]
    }

[ping-ke]

Cryptography Security Advisory Assessment

The project currently pins cryptography==46.0.7. This version falls within the affected range of all four advisories, but none of the vulnerable code paths are reachable in pyquarkchain.

Advisory	Affected Versions	Patched Version	Issue	Impact on pyquarkchain
GHSA-jwv3-5hgf-82ww	<=48.0.0	49.0.0	Exponential X.509 chain-building behavior caused by duplicate self-signed certificates, potentially leading to denial of service	Not affected. pyquarkchain does not perform X.509 certificate-chain verification.
GHSA-m2h6-j472-rp4c	<=48.0.0	49.0.0	Wildcard DNS SANs may escape X.509 Name Constraints	Not affected. pyquarkchain does not validate X.509 certificates, DNS SANs, or permittedSubtrees.
GHSA-g6cj-pr64-35w5	>=44.0.0,<50.0.0	50.0.0	PKCS#7 decryption may expose a Bleichenbacher oracle	Not affected. pyquarkchain does not process PKCS#7/S/MIME data or perform RSA PKCS#1 v1.5 decryption.
GHSA-537c-gmf6-5ccf	>=0.5.0,<48.0.1	48.0.1	The bundled OpenSSL version contains vulnerabilities in PKCS#7/CMS, QUIC, OCSP/X.509, CMP, PKCS#12, DHX, and specialized AES modes	Not affected. None of the affected OpenSSL features are used by pyquarkchain.

pyquarkchain uses cryptography only for:

• secp256k1 ECDH
• AES-CTR and AES-ECB
• HMAC-SHA256
• Constant-time comparisons

The relevant implementation is in quarkchain/p2p/ecies.py and quarkchain/p2p/peer.py.

Conclusion

• Package version: Matches all four advisory ranges
• Vulnerable code paths: Not reachable
• Practical impact on pyquarkchain: None
• Recommendation: No upgrade is required solely because of these advisories

This conclusion assumes that pyquarkchain does not later add X.509, PKCS#7/CMS, S/MIME, QUIC, OCSP, CMP, or related OpenSSL functionality.

[ping-ke]

GHSA-wj6h-64fc-37mp
Affected versions: All versions
Patched versions: None
Installed requirement: ecdsa==0.19.2
Vulnerable configuration: P-256 signing/key-generation/ECDH
pyquarkchain configuration: SECP256k1; no python-ecdsa signing or ECDH
Impact: Not affected
Action: No dependency change required

[ping-ke]

GHSA-h35f-9h28-mq5c
Affected versions: setuptools < 83.0.0
Current version: setuptools==82.0.1
Version match: Yes
Vulnerable workflow present: No
Impact on pyquarkchain: Not affected
Action: No upgrade required

[ping-ke]

GHSA-h35f-9h28-mq5c Affected versions: setuptools < 83.0.0 Current version: setuptools==82.0.1 Version match: Yes Vulnerable workflow present: No Impact on pyquarkchain: Not affected Action: No upgrade required

I have updated setuptools to 83.0.0

[qzhodl]

We may need a summary in the PR description listing which package versions differ from those in mainnet1.7.0-beta and why.

[ping-ke]

We may need a summary in the PR description listing which package versions differ from those in mainnet1.7.0-beta and why.

Add "### Dependency Version and Security Review" to PR description.