Update dependencies to clear published advisories - #14
Merged
Conversation
Three pinned dependencies carry known vulnerabilities at their current versions. Verified against the OSV database and the running image, so these are the versions actually deployed, not just what the lockfile claims. - authlib 1.4.0 -> 1.7.2. Ten advisories apply to 1.4.0, including CVE-2026-27962 (JWS JWK header injection allowing signature-verification bypass) and CVE-2026-28498 (fail-open verification in OIDC hash binding). This library implements the sign-in path, so it is the highest-value target in the tree. The client API used here (OAuth.register, authorize_redirect, authorize_access_token, userinfo) is unchanged across the jump; the internals moved to joserfc, which the app never imports. - python-multipart 0.0.20 -> 0.0.32. Seven advisories, several of them denial-of-service and parameter-smuggling issues in multipart parsing. This one parses the anonymous upload form, so it is reachable pre-auth by anyone on the internet. - jinja2 3.1.5 -> 3.1.6. CVE-2025-27516, a sandbox escape via the attr filter. All three target versions are clear of known advisories. Verified with the backend suite against a real PostgreSQL database, and by driving the live Authentik provider: the app builds the authorization request through the new Authlib and the identity provider accepts it and hands off to its login flow.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Bumps three pinned dependencies that carry published advisories at the versions
currently deployed.
authlibpython-multipartjinja2attrfilter.All three targets are clear of known advisories. The remaining pins in
requirements.txtwere checked the same way and are clean.Why it matters here
The repository is public, so the pinned versions are readable — an attacker
skips reconnaissance.
authlibsits on the authentication path andpython-multipartsits on the one endpoint an unauthenticated visitor canreach with a body.
Verification
versions installed: pass.
staging container built from this branch drives
/login, the new Authlibbuilds the authorization request (
response_type=code, canonicalredirect_uri,openid profile email groupsscope), and Authentik accepts itand hands off to its login flow.
validation,
groupsclaim). That leg needs an interactive sign-in and shouldbe confirmed after deploy.
Risk
No application code changes. The Authlib client API used here
(
OAuth.register,authorize_redirect,authorize_access_token,userinfo)is unchanged across the jump; the internals moved to
joserfc, which this appnever imports.