Replace deprecated pysnmp-lextudio dependency#35
Conversation
Replaces the deprecated pysnmp-lextudio package (which pinned pyasn1<0.6.1 and blocked the fix for the pyasn1 unbounded-recursion DoS, CVE-2026-30922) with the maintained pysnmp 7.1.x line. Code changes required by 7.x: snake_case get_cmd/next_cmd imports, awaited UdpTransportTarget.create() at all four call sites, engine.close_dispatcher(), and a flattened _walk_oid loop since next_cmd now returns a flat tuple of ObjectType instead of 6.x's list-of-rows. Adds walk regression tests pinning the flat shape and drops the now-dead pysnmp-lextudio warning filter. Supersedes PR #35 (which proposed pysnmp 6.2.6, an unmaintained migration-helper release, and kept the vulnerable pyasn1 pin). Credit to @NeoMod for flagging the deprecated dependency.
|
Thanks for this — pysnmp-lextudio's deprecation was a real problem and this PR correctly identified the maintained Superseded by 7bf1e9d on develop, which makes the same swap but to the current maintained line — |
2 participants
Summary
Replaces the deprecated
pysnmp-lextudiodependency with the officialpysnmppackage.Speedarr currently emits this warning on startup:
This PR updates the dependency from:
to:
No SNMP code changes were required. The existing import path in backend/app/services/snmp_monitor.py remains compatible with pysnmp==6.2.6.
Why pysnmp==6.2.6
The deprecated package guidance recommends migrating back to the official pysnmp package while staying in the >=6.2.0,<7.0.0 range.
pysnmp 7.x includes breaking API changes, so this PR uses 6.2.6 to preserve current Speedarr behavior and avoid a larger SNMP refactor.