gitea-admin/gh-christianlouis-inboxconverge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

SECURITY: Update dependencies to fix 11 vulnerabilities (aiohttp, authlib, cryptography, fastapi, python-multipart)

Browse Source 
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
2026-02-01 13:00:31 +00:00
parent 0dc777bb7e
commit 439d1f2ec7
2 changed files with 14 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SECURITY_REPORT.md
+9 -1
View File
@@ -64,10 +64,18 @@ Security analysis completed on February 1, 2026 for the Multi-Tenant POP3 Forwar
### 6. Dependency Security ✅ ### 6. Dependency Security ✅
- **Pinned Versions**: All dependencies use specific versions - **Pinned Versions**: All dependencies use specific versions
- **Known Vulnerabilities**: No known vulnerabilities in dependencies - **Security Patches**: All dependencies updated to patched versions
- **No Known Vulnerabilities**: All reported vulnerabilities fixed
- **Regular Updates**: Requirements can be easily updated - **Regular Updates**: Requirements can be easily updated
- **Minimal Dependencies**: Only necessary packages included - **Minimal Dependencies**: Only necessary packages included
**Recent Security Updates (2026-02-01):**
- `aiohttp`: 3.9.1 → 3.13.3 (Fixed zip bomb, DoS, directory traversal)
- `authlib`: 1.3.0 → 1.6.5 (Fixed algorithm confusion, DoS, JWT issues)
- `cryptography`: 42.0.0 → 42.0.4 (Fixed NULL pointer dereference)
- `fastapi`: 0.109.0 → 0.109.1 (Fixed ReDoS vulnerability)
- `python-multipart`: 0.0.6 → 0.0.22 (Fixed arbitrary file write, DoS, ReDoS)
**Implementation**: `backend/requirements.txt` **Implementation**: `backend/requirements.txt`
## Security Best Practices Applied ## Security Best Practices Applied
backend/requirements.txt
+5 -5
View File
@@ -1,5 +1,5 @@
# Core Framework # Core Framework
fastapi==0.109.0 fastapi==0.109.1 # Updated: Fixed ReDoS vulnerability (was 0.109.0)
uvicorn[standard]==0.27.0 uvicorn[standard]==0.27.0
pydantic==2.5.3 pydantic==2.5.3
pydantic-settings==2.1.0 pydantic-settings==2.1.0
@@ -13,8 +13,8 @@ asyncpg==0.29.0
# Authentication # Authentication
python-jose[cryptography]==3.3.0 python-jose[cryptography]==3.3.0
passlib[bcrypt]==1.7.4 passlib[bcrypt]==1.7.4
python-multipart==0.0.6 python-multipart==0.0.22 # Updated: Fixed multiple vulnerabilities (was 0.0.6)
authlib==1.3.0 authlib==1.6.5 # Updated: Fixed algorithm confusion and DoS vulnerabilities (was 1.3.0)
httpx==0.26.0 httpx==0.26.0
# Payment Processing # Payment Processing
@@ -22,7 +22,7 @@ stripe==7.11.0
# Email & Mail Processing # Email & Mail Processing
aiosmtplib==3.0.1 aiosmtplib==3.0.1
aiohttp==3.9.1 aiohttp==3.13.3 # Updated: Fixed zip bomb, DoS, and directory traversal vulnerabilities (was 3.9.1)
aioimaplib==1.0.1 aioimaplib==1.0.1
email-validator==2.1.0.post1 email-validator==2.1.0.post1
@@ -31,7 +31,7 @@ celery==5.3.6
redis==5.0.1 redis==5.0.1
# Security & Encryption # Security & Encryption
cryptography==42.0.0 cryptography==42.0.4 # Updated: Fixed NULL pointer dereference (was 42.0.0)
# Notifications # Notifications
apprise==1.7.1 apprise==1.7.1