From 63430b0d15d1bc16ffddbed6aadd115df89fd08c Mon Sep 17 00:00:00 2001 From: Don Beckham Date: Sun, 26 Jul 2026 14:04:55 -0500 Subject: [PATCH] Update dependencies to clear published advisories Three pinned dependencies carry known vulnerabilities at their current versions. Verified against the OSV database and the running image, so these are the versions actually deployed, not just what the lockfile claims. - authlib 1.4.0 -> 1.7.2. Ten advisories apply to 1.4.0, including CVE-2026-27962 (JWS JWK header injection allowing signature-verification bypass) and CVE-2026-28498 (fail-open verification in OIDC hash binding). This library implements the sign-in path, so it is the highest-value target in the tree. The client API used here (OAuth.register, authorize_redirect, authorize_access_token, userinfo) is unchanged across the jump; the internals moved to joserfc, which the app never imports. - python-multipart 0.0.20 -> 0.0.32. Seven advisories, several of them denial-of-service and parameter-smuggling issues in multipart parsing. This one parses the anonymous upload form, so it is reachable pre-auth by anyone on the internet. - jinja2 3.1.5 -> 3.1.6. CVE-2025-27516, a sandbox escape via the attr filter. All three target versions are clear of known advisories. Verified with the backend suite against a real PostgreSQL database, and by driving the live Authentik provider: the app builds the authorization request through the new Authlib and the identity provider accepts it and hands off to its login flow. --- CHANGELOG.md | 8 ++++++++ requirements.txt | 6 +++--- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 90ecdb0..f850faf 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,6 +10,14 @@ pre-1.0 scheme; dates are when the change reached `main`. operations runbook, security model, and API reference, with a docs index and a `CONTRIBUTING` guide. +### Security +- Updated dependencies to clear published advisories against the pinned + versions: Authlib 1.4.0 → 1.7.2 (signature-verification bypass in JWS JWK + header handling, CVE-2026-27962, plus nine further advisories on the OIDC + path), python-multipart 0.0.20 → 0.0.32 (denial-of-service and parameter + smuggling in multipart parsing, reachable from the public upload form), and + Jinja2 3.1.5 → 3.1.6 (CVE-2025-27516). + ## 2026-06-23 ### Added diff --git a/requirements.txt b/requirements.txt index 6ebda8b..9546c53 100644 --- a/requirements.txt +++ b/requirements.txt @@ -3,11 +3,11 @@ fastapi==0.115.6 uvicorn[standard]==0.34.0 sqlalchemy==2.0.36 psycopg2-binary==2.9.10 -authlib==1.4.0 +authlib==1.7.2 httpx==0.28.1 itsdangerous==2.2.0 -jinja2==3.1.5 -python-multipart==0.0.20 +jinja2==3.1.6 +python-multipart==0.0.32 pydantic==2.10.4 pydantic-settings==2.7.1 ua-parser==0.18.0