From c42b43cd56a98462d10fa8e617a1ff8f464fffec Mon Sep 17 00:00:00 2001
From: maziggy <mz@v8w.de>
Date: Thu, 2 Apr 2026 13:12:24 +0200
Subject: [PATCH]   Update aiohttp, cryptography, and Pygments for CVE fixes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

  aiohttp 3.13.3 → 3.13.4 (10 CVEs — header validation, parser fixes)
  cryptography 46.0.5 → 46.0.6 (CVE-2026-34073 — X.509 wildcard SAN bypass)
  Pygments 2.19.2 → 2.20.0 (CVE-2026-4539 — ReDoS in archetype lexer)
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 196670642..267248f94 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -69,6 +69,7 @@ All notable changes to Bambuddy will be documented in this file.
 
 ### Security
 - **Token-Based Auth for Media Endpoints** — Camera streams, snapshots, thumbnails, timelapse videos, photos, QR codes, and cover images served via `<img>`/`<video>` tags now require a stream token query parameter (`?token=xxx`) when authentication is enabled. Previously these endpoints were unauthenticated because browser media elements cannot send `Authorization` headers. The frontend obtains a 60-minute reusable token via `POST /printers/camera/stream-token` (requires `CAMERA_VIEW` permission) and automatically appends it to all media URLs. Affects endpoints in camera, archives, library, printers, print-log, and external-links routes. When auth is disabled (default for local installs), behavior is unchanged — no token required.
+- **Dependency Security Updates** — Updated `aiohttp` 3.13.3 → 3.13.4 (10 CVEs — HTTP header validation and parser fixes), `cryptography` 46.0.5 → 46.0.6 (CVE-2026-34073 — X.509 wildcard SAN validation bypass), and `Pygments` 2.19.2 → 2.20.0 (CVE-2026-4539 — ReDoS in archetype lexer).
 
 ### Fixed
 - **Native Install Misdetected as Docker in LXC Containers** — The update check falsely identified native installs as Docker when running inside Proxmox LXC containers. The detection logic used `.git/` directory absence as a Docker fallback, but LXC containers may also lack `.git/` depending on how the install was deployed. Replaced the `.git/` fallback with a proper check of `/run/systemd/container` which only matches Docker/Podman/OCI runtimes, not LXC. Native installs in LXC containers now correctly show the in-app update button instead of Docker Compose instructions.