[rab1prasad]

Most relevant to us, because our code uses these directly:

• PyJWT 2.11 → 2.15.1 (1 critical, 5 high). Our login and widget tokens are signed with PyJWT. The old version could accept a public key as the signing secret, which lets someone forge tokens.
• Starlette 0.46 → 1.10 (via FastAPI 0.136.3) (3 high). Fixes a crash-the-server attack using the Range header, and form-size limits that were silently ignored.
• aiohttp 3.13 → 3.14.5 (4 high, 28 lower). Fixes unbounded memory/CPU use, missing request timeouts, a memory-read bug in its HTTP parser, and request smuggling.
• python-multipart 0.0.22 → 0.0.32 (2 high). Fixes CPU and memory exhaustion from malicious form uploads.
• pypdf 6.14 → 6.21.4 (11 high). Fixes very long runtimes and huge memory use from crafted PDFs.
• anyio and certifi (1 critical each). anyio fixes a TLS bug that could let a fake certificate pass. certifi drops root certificates whose intermediate keys were compromised.

Remote code execution fixes in libraries pipecat pulls in:

• Pillow 11.3 → 13.0 (5 critical, 35 high): heap overflows in image decoders and a Ghostscript command-injection bug.
• nltk 3.9 → 3.10.4 (3 critical, 19 high): unsafe loading of pickled data that can run code.
• transformers 5.1 → 5.21 (4 high): code running while a model loads, and file-write bugs.
• fsspec (template injection leading to code execution) and lxml (XML parsing that can read local files).

The rest are mostly denial-of-service and leak fixes:

• cryptography: OpenSSL inside the package had known bugs, and a decryption weakness
• urllib3: auth headers forwarded to other sites on redirect
• mcp: missing origin and session checks
• pyasn1, filelock, black, and 9 more with only moderate or low issues

dragontts gets 5 of the same packages: anyio, certifi, cryptography, pyasn1 and urllib3.

uv.lock: upgrade only the 32 vulnerable packages (aiohttp, starlette, pillow, pyjwt, pypdf, nltk, cryptography, ...); dragontts/uv.lock: 5. fastapi pinned >=0.115.12,<0.137 (0.137 nests routers); Pillow forced

=13 via uv override (pipecat 1.1.0 caps <13). Remaining: pipecat-ai
1.1.0 dev-runner advisories, not reachable from our code.

Summary by CodeRabbit

• Chores
  • Updated dependency version requirements to allow a broader range of web framework versions and require a newer minimum version of the image-processing library.
  • No direct changes to app features or behavior are included in this update.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 708019f6-88a9-4993-a557-61de7c9be535

Commits

Reviewing files that changed from the base of the PR and between c2d32aa and af860bb.

Files ignored due to path filters: 2

• dragontts/uv.lock is excluded by !**/*.lock
• uv.lock is excluded by !**/*.lock

Files selected for processing: 1

• pyproject.toml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Walkthrough

The project configuration replaces the exact FastAPI version with a bounded range and adds a uv override requiring Pillow 13.0.0 or later.

Changes

Dependency constraints

Layer / File(s)	Summary
Python dependency constraints pyproject.toml	FastAPI now uses the range >=0.115.12,<0.137. A uv override sets Pillow to >=13.0.0.

Priority: Normal

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other

Suggested reviewers: swaroopvarma1

Merge Risk: Minimal · up to af860

No merge-blocking issue is established for the dependency constraints. Merge after normal dependency resolution and compatibility checks pass.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title "fix: package-vulnerablities" is a short conventional-commit style title that names the main theme: fixing vulnerable packages. The PR objectives confirm the main change is updating dependen…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title "fix: package-vulnerablities" is a short conventional-commit style title that names the main theme: fixing vulnerable packages. The PR objectives confirm the main change is updating dependency lockfiles to upgrade 32 vulnerable packages. The title does not name specific packages or the FastAPI pin and Pillow override, which is acceptable because it is not required to cover every detail. The title contains a spelling error ("vulnerablities" should be "vulnerabilities"), which lowers clarity but does not make the title unrelated.

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the version list,
Two bounds for FastAPI fit.
Pillow gets a newer floor,
The config holds no changes more.
Soft paws hop through tidy rows,
Then off the rabbit goes.}

_{Comment @coderabbitai help to get the list of available commands.}