Fix possible fix(deps): 17 vulnerable dependencies in requirements.txt - #207
Closed
begininvoke wants to merge 1 commit into
Closed
Fix possible fix(deps): 17 vulnerable dependencies in requirements.txt#207begininvoke wants to merge 1 commit into
begininvoke wants to merge 1 commit into
Conversation
Member
|
starlette==1.3.1 would break the install. fastapi==0.115.4 requires starlette<0.42.0,>=0.40.0. The PR jumps starlette across a major version while leaving fastapi pinned. That's a hard dependency conflict — pip will refuse to resolve |
Contributor
ronibhakta1
pushed a commit
to ronibhakta1/lenny
that referenced
this pull request
Sep 6, 2026
Takes the safe subset of the automated PRs ArchiveLabs#206/ArchiveLabs#207 and drops the part that would have broken the build. internetarchive 5.2.0 -> 5.5.1 CVE-2025-58438, path traversal in File.download(). Not reachable from Lenny today (the only .download() call is StandardEbooks', a different library) but it is a one-line fix and I would rather not depend on that staying true. python-multipart 0.0.6 -> 0.0.30 Below what fastapi's own `standard` extra requires (>=0.0.7). Used for every Form() in the API, including the OAuth token and consent endpoints. authlib 1.3.1 -> 1.6.9 Verifies JWTs and JWKS in the OIDC client path (core/external_auth.py). Verified the two APIs that file uses still import. urllib3 2.4.0 -> 2.6.3 Patch bump. NOT bumping starlette. ArchiveLabs#206/ArchiveLabs#207 propose 0.41.3 -> 1.3.1, but the pinned fastapi==0.115.4 requires `starlette<0.42.0,>=0.40.0`. That jump crosses a major version and conflicts with a pin the PRs leave untouched, so it would break resolution rather than fix anything. Moving starlette means moving fastapi, which is a separate change with its own testing. On the provenance question, since these came from an outside automated scanner: all four target versions are real releases of the canonical PyPI projects, no index or VCS URL is introduced, and each target is *older* than that project's current release — the signature of a scanner picking the minimum version that clears a CVE rather than an attacker steering to their own artifact. Verified against the PyPI simple index. Resolves cleanly with the untouched pins; 293 passed, 13 skipped. Refs ArchiveLabs#205 Claude-Session: https://claude.ai/code/session_01UViYm1nKqJkiKJWJUr1eas
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This changes
requirements.txtto address something a scan flagged. It is around line 18.The installed
internetarchivepackage (v5.2.0) contains a critical path traversal vulnerability (CVE-2025-58438) within itsFile.download()method. The function fails to sanitize supplied filenames or validate the final absolute path before writing files. Attackers can inject../sequences into archive metadata, causing downloads to escape the intended directory and overwrite arbitrary files. This can lead to configuration tampering, privilege escalation, or remote code execution depending on context. Due to the severe impact and straightforward exploitation vector, this is classified as CRITICAL. Immediate remediation is required.Upgrade internetarchive, authlib, python-multipart, starlette, and urllib3 to versions that address the reported critical CVEs, reducing security risk. This minimal change aligns with the repository's manifest and preserves existing behavior.
For reference: rule
CVE-2025-58438. Rated critical.I do not know the codebase, so please check the change fits how the rest of it works. Happy to adjust it or close this if the reasoning is off.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.