public_git/bambuddy
1
0
Fork 0
mirror of https://github.com/maziggy/bambuddy.git synced 2026-09-30 03:01:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

chore(deps): pin aiohttp >=3.14.0 for CVE-2026-34993 + CVE-2026-47265

Browse Source 
pywebpush brings aiohttp in transitively with no version bound, so the
  resolver kept installing 3.13.5. Both CVEs are fixed in 3.14.0; direct
  floor pin here, same shape as the existing idna / urllib3 / starlette
  transitive pins. Our usage in services/external_camera.py is unaffected
  by 3.14.0 (ClientSession, ClientTimeout, ClientError, iter_chunked all
  unchanged); 29 external_camera tests pass on 3.14.1; pip-audit clean.
This commit is contained in:
maziggy
2026-06-09 13:40:26 +02:00
parent 53b318c797
commit 50ad5539b0
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
requirements.txt
+8
View File
@@ -101,6 +101,14 @@ urllib3>=2.7.0
# directly to stop the resolver from picking the vulnerable build.
starlette>=1.0.1
# Transitive of pywebpush (unpinned `aiohttp` requirement). aiohttp 3.13.5
# has CVE-2026-34993 and CVE-2026-47265, both fixed in 3.14.0. pywebpush
# doesn't declare an upper bound either way, so without this pin the
# resolver keeps installing the vulnerable 3.13.x line. Our direct usage
# in services/external_camera.py (ClientSession, ClientTimeout, ClientError,
# iter_chunked) is unaffected by 3.14.0.
aiohttp>=3.14.0
# Plate Detection (optional - enables build plate empty detection)
opencv-python-headless>=4.8.0
numpy>=1.24.0