ewilliams28/turnstone
1
0
Fork 0
mirror of https://github.com/turnstonelabs/turnstone.git synced 2026-08-12 23:12:23 -06:00
Code Issues Packages Projects Releases Wiki Activity

fix(deps): enforce cryptography + starlette security floors

Browse Source 
main's lockfile was already on the patched versions (cryptography 49.0.0,
starlette 1.3.1) via renovate, but the pyproject floors (>=42, >=1.0.1) still
permitted a regression to vulnerable versions. Raise the floors to match
stable/1.6's v1.6.7 security fix:
- cryptography >=48.0.1 (GHSA-537c-gmf6-5ccf — bundled OpenSSL vulnerable <48.0.1)
- starlette >=1.3.1 (CVE-2026-54282 host spoof + CVE-2026-54283 url-encoded form DoS)
This commit is contained in:
Patrick Buckley
2026-06-16 04:39:26 -07:00
parent f714e49e02
commit e562d04e8b
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pyproject.toml
+2 -2
View File
@@ -27,7 +27,7 @@ dependencies = [
"anthropic>=0.108", # claude-fable-5 support; hard runtime floor is 0.105 (mid-conversation system blocks)
"httpx>=0.28",
"mcp>=1.27,<2", # v2 is a breaking rewrite (2.0.0a1 live 2026-06-11; stable ~2026-07-27) — streamablehttp_client removed, 2-tuple transport, snake_case types; migrate deliberately
"starlette>=1.0.1", # PYSEC-2026-161: host-header path-injection in URL reconstruction (auth-bypass on apps comparing reconstructed URL paths)
"starlette>=1.3.1", # CVE-2026-54282 (path->authority host spoof) + CVE-2026-54283 (url-encoded form DoS); supersedes the PYSEC-2026-161 host-header path-injection floor
"uvicorn>=0.34",
"sse-starlette>=2.0",
"httpx-sse>=0.4",
@@ -39,7 +39,7 @@ dependencies = [
"structlog>=24.1",
"PyJWT>=2.8",
"bcrypt>=4.0",
"cryptography>=42",
"cryptography>=48.0.1", # GHSA-537c-gmf6-5ccf: PyPI wheels <48.0.1 bundle a vulnerable statically-linked OpenSSL (2026-06-09 secadv)
"lacme>=1.0.5",
"python-frontmatter>=1.0",
"pypdfium2>=4", # PDF text-extract + rasterize for models without native PDF input (core/pdf.py)
uv.lock
Generated
+2 -2
View File
@@ -2495,7 +2495,7 @@ requires-dist = [
{ name = "anthropic", specifier = ">=0.108" },
{ name = "bcrypt", specifier = ">=4.0" },
{ name = "croniter", specifier = ">=3.0" },
{ name = "cryptography", specifier = ">=42" },
{ name = "cryptography", specifier = ">=48.0.1" },
{ name = "discord-py", marker = "extra == 'discord'", specifier = ">=2.4" },
{ name = "httpx", specifier = ">=0.28" },
{ name = "httpx-sse", specifier = ">=0.4" },
@@ -2516,7 +2516,7 @@ requires-dist = [
{ name = "slack-bolt", marker = "extra == 'test'", specifier = ">=1.18" },
{ name = "sqlalchemy", specifier = ">=2.0" },
{ name = "sse-starlette", specifier = ">=2.0" },
{ name = "starlette", specifier = ">=1.0.1" },
{ name = "starlette", specifier = ">=1.3.1" },
{ name = "structlog", specifier = ">=24.1" },
{ name = "turnstone", extras = ["discord", "slack"], marker = "extra == 'all'" },
{ name = "uvicorn", specifier = ">=0.34" },