public_git/bambuddy
1
0
Fork 0
mirror of https://github.com/maziggy/bambuddy.git synced 2026-09-30 03:01:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

chore(deps): backend security floor bumps + 422 constant rename

Browse Source 
requirements.txt
    - cryptography 46.0.7 -> 48.0.1 floor (GHSA-537c-gmf6-5ccf,
      non-contiguous Python buffer handling)
    - python-multipart 0.0.27 -> 0.0.31 floor (CVE-2026-53538/53539/53540,
      multipart parser hardening)
    - starlette 1.1.0 -> 1.3.1 floor (CVE-2026-54282/54283, FormParser
      limit enforcement + StaticFiles absolute-path rejection)
    - pyopenssl 26.0.0 -> 26.3.0 floor (NOT a security fix; pyOpenSSL
      <26.3.0 caps cryptography<47 and would otherwise downgrade out
      of the GHSA-537c-gmf6-5ccf fix line)

  backend/app/api/routes/mfa.py
    - 3x HTTP_422_UNPROCESSABLE_ENTITY -> HTTP_422_UNPROCESSABLE_CONTENT
      (the former is deprecated in starlette 1.3.x, same 422 wire status;
       the 2 remaining warnings are inside FastAPI itself, upstream's)

  Release-notes review done before bump: cryptography 47/48 dropped
  binary EC, CFB/OFB/CFB8, Camellia, PUBLIC_KEY_TYPES/PRIVATE_KEY_TYPES,
  OpenSSL 1.1.x, Python 3.8 -- grep clean against every removed surface;
  starlette's newly-enforced max_part_size=1MB only applies to text form
  fields (verified in MultiPartParser.on_part_data), file streams from
  UploadFile = File(...) are unaffected; python-multipart 0.0.30 dropped
  RFC 2231/5987 filename* parsing, minor cosmetic impact on non-ASCII
  filename uploads, plain filename= fallback still works.
This commit is contained in:
maziggy
2026-06-19 12:02:30 +02:00
parent 9e24d8d297
commit ceb0616c82
3 changed files with 20 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
requirements.txt
+16 -6
View File
@@ -31,7 +31,14 @@ aioftp>=0.22.0
# Virtual Printer (emulates Bambu printer for slicer uploads)
pyftpdlib>=2.0.0
cryptography>=46.0.7
# 46.x line has GHSA-537c-gmf6-5ccf; 48.0.1 is the fix release. Upstream's
# X.509 / PKCS#7 surface is in our trust path via asyncssh, pyOpenSSL,
# py-vapid, http_ece, pywebpush.
cryptography>=48.0.1
# Transitive of asyncssh / pywebpush. pyopenssl<26.3.0 caps `cryptography<47`
# so without this floor the resolver either downgrades cryptography below
# the GHSA-537c-gmf6-5ccf fix line or installs an inconsistent pair.
pyopenssl>=26.3.0
# SpoolBuddy remote SSH updates (pure-Python SSH client; avoids the
# OpenSSH `ssh` binary which calls getpwuid() and fails in Docker when
@@ -48,7 +55,9 @@ openpyxl>=3.1.0
pywebpush>=2.0.0
# Utilities
python-multipart>=0.0.27
# 0.0.27 → 0.0.31 clears three CVEs in the parser surface that FastAPI
# uses for multipart form bodies (CVE-2026-53538/53539/53540).
python-multipart>=0.0.31
aiofiles>=23.0.0
# QR Code generation
@@ -112,10 +121,11 @@ curl_cffi>=0.7.0
# would silently keep installing the vulnerable 2.6.x line.
urllib3>=2.7.0
# Transitive of fastapi. starlette 1.0.0 has PYSEC-2026-161; 1.0.1 is the
# fixed release. fastapi's range still admits 1.0.0 so we pin the floor
# directly to stop the resolver from picking the vulnerable build.
starlette>=1.0.1
# Transitive of fastapi. starlette 1.0.0 has PYSEC-2026-161; 1.1.x has
# CVE-2026-54282/54283; 1.3.1 is the fixed release. fastapi's range still
# admits the vulnerable builds, so we pin the floor directly to stop the
# resolver from picking them.
starlette>=1.3.1
# Transitive of pywebpush (unpinned `aiohttp` requirement). aiohttp 3.13.5
# has CVE-2026-34993 and CVE-2026-47265, both fixed in 3.14.0. pywebpush