mirror of
https://github.com/maziggy/bambuddy.git
synced 2026-09-30 03:01:21 +02:00
maziggy
0b43ac0d25
pip-audit flagged two advisories at the resolved versions in the venv. Neither is reachable in shipped Bambuddy, but the pins are taken so the audit stays clean and a future reachable advisory in either package isn't masked by existing noise. pydantic-settings 2.14.2 patches GHSA-4xgf-cpjx-pc3j — NestedSecretsSettingsSource with secrets_nested_subdir=True followed symlinks pointing outside the configured secrets_dir, reading out-of-tree files into settings values and bypassing the documented secrets_dir_max_size cap. Affected: >=2.12.0, <2.14.2. Bambuddy uses pydantic-settings only for env-var-backed config; the secrets-dir loader is not used (grep clean on NestedSecretsSettingsSource / secrets_nested_subdir / secrets_dir under backend/). msgpack 1.2.1 patches GHSA-6v7p-g79w-8964 — reusing an Unpacker instance after it caught an error can crash with SEGV, which is a DoS vector on untrusted input. msgpack is not a runtime dep of Bambuddy; it enters the tree only as a transitive of CacheControl, itself pulled by pip-audit (the very tool that surfaced the advisory). Pin placed in requirements-dev.txt next to pip-audit so it travels with the security-scan tooling rather than implying a runtime use.
27 lines
903 B
Plaintext
27 lines
903 B
Plaintext
# Development and testing dependencies
|
|
pytest>=8.0.0
|
|
pytest-asyncio>=0.23.0
|
|
pytest-cov>=4.1.0
|
|
pytest-xdist>=3.5.0
|
|
pytest-timeout>=2.4.0
|
|
# Test-suite sharding for CI matrix. Splits the test set evenly across N
|
|
# shards via --splits/--group; falls back to test-name hashing on the first
|
|
# run, and uses recorded durations on subsequent runs (.test_durations).
|
|
pytest-split>=0.9.0
|
|
httpx>=0.27.0
|
|
ruff>=0.8.0
|
|
pre-commit>=4.0
|
|
|
|
# Required by pyftpdlib TLS_FTPHandler for mock FTP server tests
|
|
pyOpenSSL>=26.0.0
|
|
|
|
# Security scanning
|
|
bandit[sarif]>=1.7.0
|
|
pip-audit>=2.7.0
|
|
# Transitive of pip-audit→CacheControl. 1.2.1 patches GHSA-6v7p-g79w-8964
|
|
# (Unpacker SEGV/DoS on reuse after caught error). Not a runtime dep of
|
|
# Bambuddy — pinned here so the audit stays clean.
|
|
msgpack>=1.2.1
|
|
# Secrets scan: gitleaks (Go binary, not a Python package).
|
|
# Install: go install github.com/zricethezav/gitleaks/v8@latest
|