Ben Stull
bc60ad97be
Clears Patchwatch advisories #36–#40 on the OHM deployment (affecting ohm-rfc-app + rfc-app-ppe) by forcing the vulnerable dependencies to patched versions: - backend/requirements.txt: floor-pin tqdm>=4.66.3 (#37/#39/#40, resolves 4.68.2) and idna>=3.15 (#38, resolves 3.18) — both arrive transitively with no lockfile, so a floor-pin is the robust fix. - frontend/package.json: vitest ^3.0.0 -> ^4.1.0 (#36, resolves 4.1.8; dev/test-only, GHSA-5xrq-8626-4rwp UI-server file read/exec). Lockfile regenerated. No behavior change; backend (685), frontend (66), and localhost E2E (5) suites pass. Issues are closed after the change is deployed and re-scanned, not on merge. Patchwatch Phase 2 remediation, session ohm/0095. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
20 lines
566 B
Plaintext
20 lines
566 B
Plaintext
fastapi>=0.115
|
|
uvicorn[standard]>=0.32
|
|
httpx>=0.27
|
|
python-dotenv>=1.0
|
|
itsdangerous>=2.2
|
|
pydantic>=2.9
|
|
anthropic>=0.39
|
|
google-generativeai>=0.8
|
|
openai>=1.50
|
|
PyYAML>=6.0
|
|
bcrypt>=4.2
|
|
|
|
# Transitive-dependency security floors (Patchwatch #37/#38/#39/#40).
|
|
# tqdm and idna arrive transitively; these floor-pins force resolution to
|
|
# the patched versions so the deployed environment clears the advisories.
|
|
# tqdm>=4.66.3 covers GHSA-r7q7-xcjw-qx8q, GHSA-g7vv-2v7x-gj9p, PYSEC-2017-74.
|
|
# idna>=3.15 covers GHSA-65pc-fj4g-8rjx (CVE-2024-3651 bypass).
|
|
tqdm>=4.66.3
|
|
idna>=3.15
|