Ben Stull
cdbc8078b6
backend/requirements.txt carries only loose `>=` direct constraints and no compiled lockfile, so osv-scanner v2 resolves the transitive graph and pins each unpinned transitive package to its MINIMUM published version — surfacing CVEs in ancient releases pip would never install. That fired a phantom HIGH (tqdm 4.9.0, GHSA-r7q7-xcjw-qx8q) plus an idna finding on the OHM Patchwatch radar, even though the live deployment runs patched versions. Add `tqdm>=4.66.3` and `idna>=3.15` to anchor the resolver to the patched range. osv-scanner now reports zero findings. No direct-import / schema / API / config change; deployed installs already satisfy the floors. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
21 lines
676 B
Plaintext
21 lines
676 B
Plaintext
fastapi>=0.115
|
|
uvicorn[standard]>=0.32
|
|
httpx>=0.27
|
|
python-dotenv>=1.0
|
|
itsdangerous>=2.2
|
|
pydantic>=2.9
|
|
anthropic>=0.39
|
|
google-generativeai>=0.8
|
|
openai>=1.50
|
|
PyYAML>=6.0
|
|
bcrypt>=4.2
|
|
|
|
# Security floors on unbounded *transitive* deps (not direct imports). osv-scanner
|
|
# resolves an unpinned transitive package to its MINIMUM PyPI version, which surfaces
|
|
# CVEs in ancient releases pip would never actually install. These floors keep the
|
|
# Patchwatch radar (and any scan) anchored to the patched range.
|
|
# tqdm <- google-generativeai ; GHSA-r7q7-xcjw-qx8q et al., fixed in 4.66.3
|
|
# idna <- httpx / anthropic ; GHSA-65pc-fj4g-8rjx, fixed in 3.15
|
|
tqdm>=4.66.3
|
|
idna>=3.15
|