holetron-lab/fleet-memory
1
0
Fork 0
Code Releases Packages Activity Actions

fix: resolve remaining Dependabot security alerts (#705)

Browse source 
- python-multipart: pin >=0.0.22 (arbitrary file write via non-default config)
- requests: pin >=2.33.0 in litellm, langgraph, crewai integrations (insecure temp file reuse)

Remaining unfixable alerts: diskcache (<=5.6.3, no patch) and Pygments (<=2.19.2, no patch).
This commit is contained in:
Nicolò Boschi 2026-03-26 13:43:27 +01:00 committed by GitHub
parent b6a4f17cbe
commit ea4df8dbb5
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
8 changed files with 30 additions and 23 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
hindsight-api-slim/pyproject.toml
View file

@ -57,6 +57,7 @@ dependencies = [
"authlib>=1.6.9", # Account takeover/JWS header injection vulnerability fix
"pyjwt>=2.12.0", # Accepts unknown crit header extensions fix
"orjson>=3.11.6", # Unbounded recursion DoS fix
"python-multipart>=0.0.22", # Arbitrary file write via non-default configuration fix
"tornado>=6.5.5", # DoS multipart/incomplete cookie validation fix
"aiohttp>=3.13.3", # Multiple DoS vulnerabilities
"claude-agent-sdk>=0.1.27",

1
hindsight-integrations/crewai/pyproject.toml
View file

@ -33,6 +33,7 @@ dependencies = [
"cryptography>=46.0.5", # Subgroup attack vulnerability fix
"pillow>=12.1.1", # Out-of-bounds write in PSD image loading fix
"pyjwt>=2.12.0", # Accepts unknown crit header extensions fix
"requests>=2.33.0", # Insecure temp file reuse in extract_zipped_paths()
]
[project.optional-dependencies]

10
hindsight-integrations/crewai/uv.lock
View file

@ -1,5 +1,4 @@
version = 1
revision = 1
requires-python = ">=3.10"
resolution-markers = [
"python_full_version >= '3.13'",
@ -1018,6 +1017,7 @@ dependencies = [
{ name = "hindsight-client" },
{ name = "pillow" },
{ name = "pyjwt" },
{ name = "requests" },
]
[package.optional-dependencies]
@ -1040,8 +1040,8 @@ requires-dist = [
{ name = "pyjwt", specifier = ">=2.12.0" },
{ name = "pytest", marker = "extra == 'dev'", specifier = ">=7.0.0" },
{ name = "pytest-mock", marker = "extra == 'dev'", specifier = ">=3.10.0" },
{ name = "requests", specifier = ">=2.33.0" },
]
provides-extras = ["dev"]
[package.metadata.requires-dev]
dev = [{ name = "pytest", specifier = ">=9.0.2" }]
@ -3116,7 +3116,7 @@ wheels = [
[[package]]
name = "requests"
version = "2.32.5"
version = "2.33.0"
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "certifi" },
@ -3124,9 +3124,9 @@ dependencies = [
{ name = "idna" },
{ name = "urllib3" },
]
sdist = { url = "https://files.pythonhosted.org/packages/c9/74/b3ff8e6c8446842c3f5c837e9c3dfcfe2018ea6ecef224c710c85ef728f4/requests-2.32.5.tar.gz", hash = "sha256:dbba0bac56e100853db0ea71b82b4dfd5fe2bf6d3754a8893c3af500cec7d7cf", size = 134517 }
sdist = { url = "https://files.pythonhosted.org/packages/34/64/8860370b167a9721e8956ae116825caff829224fbca0ca6e7bf8ddef8430/requests-2.33.0.tar.gz", hash = "sha256:c7ebc5e8b0f21837386ad0e1c8fe8b829fa5f544d8df3b2253bff14ef29d7652", size = 134232 }
wheels = [
{ url = "https://files.pythonhosted.org/packages/1e/db/4254e3eabe8020b458f1a747140d32277ec7a271daf1d235b70dc0b4e6e3/requests-2.32.5-py3-none-any.whl", hash = "sha256:2462f94637a34fd532264295e186976db0f5d453d1cdd31473c85a6a161affb6", size = 64738 },
{ url = "https://files.pythonhosted.org/packages/56/5d/c814546c2333ceea4ba42262d8c4d55763003e767fa169adc693bd524478/requests-2.33.0-py3-none-any.whl", hash = "sha256:3324635456fa185245e24865e810cecec7b4caf933d7eb133dcde67d48cee69b", size = 65017 },
]
[[package]]

2
hindsight-integrations/langgraph/pyproject.toml
View file

@ -30,6 +30,8 @@ classifiers = [
dependencies = [
"langchain-core>=0.3.0",
"hindsight-client>=0.4.0",
# Transitive dependency security fixes
"requests>=2.33.0", # Insecure temp file reuse in extract_zipped_paths()
]
[project.optional-dependencies]

16
hindsight-integrations/langgraph/uv.lock
View file

@ -1,5 +1,4 @@
version = 1
revision = 1
requires-python = ">=3.10"
[[package]]
@ -490,11 +489,12 @@ wheels = [
[[package]]
name = "hindsight-langgraph"
version = "0.1.0"
version = "0.1.1"
source = { editable = "." }
dependencies = [
{ name = "hindsight-client" },
{ name = "langchain-core" },
{ name = "requests" },
]
[package.optional-dependencies]
@ -516,10 +516,10 @@ dev = [
requires-dist = [
{ name = "hindsight-client", specifier = ">=0.4.0" },
{ name = "langchain-core", specifier = ">=0.3.0" },
{ name = "langgraph", marker = "extra == 'all'", specifier = ">=0.5.0" },
{ name = "langgraph", marker = "extra == 'langgraph'", specifier = ">=0.5.0" },
{ name = "langgraph", marker = "extra == 'all'", specifier = ">=0.3.0" },
{ name = "langgraph", marker = "extra == 'langgraph'", specifier = ">=0.3.0" },
{ name = "requests", specifier = ">=2.33.0" },
]
provides-extras = ["langgraph", "all"]
[package.metadata.requires-dev]
dev = [
@ -1349,7 +1349,7 @@ wheels = [
[[package]]
name = "requests"
version = "2.32.5"
version = "2.33.0"
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "certifi" },
@ -1357,9 +1357,9 @@ dependencies = [
{ name = "idna" },
{ name = "urllib3" },
]
sdist = { url = "https://files.pythonhosted.org/packages/c9/74/b3ff8e6c8446842c3f5c837e9c3dfcfe2018ea6ecef224c710c85ef728f4/requests-2.32.5.tar.gz", hash = "sha256:dbba0bac56e100853db0ea71b82b4dfd5fe2bf6d3754a8893c3af500cec7d7cf", size = 134517 }
sdist = { url = "https://files.pythonhosted.org/packages/34/64/8860370b167a9721e8956ae116825caff829224fbca0ca6e7bf8ddef8430/requests-2.33.0.tar.gz", hash = "sha256:c7ebc5e8b0f21837386ad0e1c8fe8b829fa5f544d8df3b2253bff14ef29d7652", size = 134232 }
wheels = [
{ url = "https://files.pythonhosted.org/packages/1e/db/4254e3eabe8020b458f1a747140d32277ec7a271daf1d235b70dc0b4e6e3/requests-2.32.5-py3-none-any.whl", hash = "sha256:2462f94637a34fd532264295e186976db0f5d453d1cdd31473c85a6a161affb6", size = 64738 },
{ url = "https://files.pythonhosted.org/packages/56/5d/c814546c2333ceea4ba42262d8c4d55763003e767fa169adc693bd524478/requests-2.33.0-py3-none-any.whl", hash = "sha256:3324635456fa185245e24865e810cecec7b4caf933d7eb133dcde67d48cee69b", size = 65017 },
]
[[package]]

1
hindsight-integrations/litellm/pyproject.toml
View file

@ -37,6 +37,7 @@ dependencies = [
"aiohttp>=3.13.3", # Multiple DoS vulnerabilities
"filelock>=3.20.3", # TOCTOU race condition
"urllib3>=2.6.3", # Decompression-bomb safeguards bypass
"requests>=2.33.0", # Insecure temp file reuse in extract_zipped_paths()
]
[project.optional-dependencies]

14
hindsight-integrations/litellm/uv.lock
View file

@ -1,5 +1,4 @@
version = 1
revision = 1
requires-python = ">=3.10"
resolution-markers = [
"python_full_version >= '3.14'",
@ -691,12 +690,13 @@ wheels = [
[[package]]
name = "hindsight-litellm"
version = "0.4.19"
version = "0.5.0"
source = { editable = "." }
dependencies = [
{ name = "aiohttp" },
{ name = "filelock" },
{ name = "litellm" },
{ name = "requests" },
{ name = "urllib3" },
]
@ -716,13 +716,13 @@ dev = [
requires-dist = [
{ name = "aiohttp", specifier = ">=3.13.3" },
{ name = "filelock", specifier = ">=3.20.3" },
{ name = "litellm", specifier = ">=1.40.0" },
{ name = "litellm", specifier = ">=1.40.0,<=1.82.6" },
{ name = "pytest", marker = "extra == 'dev'", specifier = ">=7.0.0" },
{ name = "pytest-asyncio", marker = "extra == 'dev'", specifier = ">=0.21.0" },
{ name = "pytest-mock", marker = "extra == 'dev'", specifier = ">=3.10.0" },
{ name = "requests", specifier = ">=2.33.0" },
{ name = "urllib3", specifier = ">=2.6.3" },
]
provides-extras = ["dev"]
[package.metadata.requires-dev]
dev = [{ name = "pytest", specifier = ">=9.0.2" }]
@ -1723,7 +1723,7 @@ wheels = [
[[package]]
name = "requests"
version = "2.32.5"
version = "2.33.0"
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "certifi" },
@ -1731,9 +1731,9 @@ dependencies = [
{ name = "idna" },
{ name = "urllib3" },
]
sdist = { url = "https://files.pythonhosted.org/packages/c9/74/b3ff8e6c8446842c3f5c837e9c3dfcfe2018ea6ecef224c710c85ef728f4/requests-2.32.5.tar.gz", hash = "sha256:dbba0bac56e100853db0ea71b82b4dfd5fe2bf6d3754a8893c3af500cec7d7cf", size = 134517 }
sdist = { url = "https://files.pythonhosted.org/packages/34/64/8860370b167a9721e8956ae116825caff829224fbca0ca6e7bf8ddef8430/requests-2.33.0.tar.gz", hash = "sha256:c7ebc5e8b0f21837386ad0e1c8fe8b829fa5f544d8df3b2253bff14ef29d7652", size = 134232 }
wheels = [
{ url = "https://files.pythonhosted.org/packages/1e/db/4254e3eabe8020b458f1a747140d32277ec7a271daf1d235b70dc0b4e6e3/requests-2.32.5-py3-none-any.whl", hash = "sha256:2462f94637a34fd532264295e186976db0f5d453d1cdd31473c85a6a161affb6", size = 64738 },
{ url = "https://files.pythonhosted.org/packages/56/5d/c814546c2333ceea4ba42262d8c4d55763003e767fa169adc693bd524478/requests-2.33.0-py3-none-any.whl", hash = "sha256:3324635456fa185245e24865e810cecec7b4caf933d7eb133dcde67d48cee69b", size = 65017 },
]
[[package]]

8
uv.lock
View file

@ -1568,6 +1568,7 @@ dependencies = [
{ name = "pyjwt", extra = ["crypto"] },
{ name = "python-dateutil" },
{ name = "python-dotenv" },
{ name = "python-multipart" },
{ name = "rich" },
{ name = "sqlalchemy" },
{ name = "tiktoken" },
@ -1683,6 +1684,7 @@ requires-dist = [
{ name = "pytest-xdist", marker = "extra == 'test'", specifier = ">=3.0.0" },
{ name = "python-dateutil", specifier = ">=2.8.0" },
{ name = "python-dotenv", specifier = ">=1.0.0" },
{ name = "python-multipart", specifier = ">=0.0.22" },
{ name = "rich", specifier = ">=13.0.0" },
{ name = "safetensors", marker = "extra == 'local-ml'", specifier = ">=0.6.2" },
{ name = "sentence-transformers", marker = "extra == 'local-ml'", specifier = ">=3.3.0" },
@ -4180,11 +4182,11 @@ wheels = [
[[package]]
name = "python-multipart"
version = "0.0.20"
version = "0.0.22"
source = { registry = "https://pypi.org/simple" }
sdist = { url = "https://files.pythonhosted.org/packages/f3/87/f44d7c9f274c7ee665a29b885ec97089ec5dc034c7f3fafa03da9e39a09e/python_multipart-0.0.20.tar.gz", hash = "sha256:8dd0cab45b8e23064ae09147625994d090fa46f5b0d1e13af944c331a7fa9d13", size = 37158 }
sdist = { url = "https://files.pythonhosted.org/packages/94/01/979e98d542a70714b0cb2b6728ed0b7c46792b695e3eaec3e20711271ca3/python_multipart-0.0.22.tar.gz", hash = "sha256:7340bef99a7e0032613f56dc36027b959fd3b30a787ed62d310e951f7c3a3a58", size = 37612 }
wheels = [
{ url = "https://files.pythonhosted.org/packages/45/58/38b5afbc1a800eeea951b9285d3912613f2603bdf897a4ab0f4bd7f405fc/python_multipart-0.0.20-py3-none-any.whl", hash = "sha256:8a62d3a8335e06589fe01f2a3e178cdcc632f3fbe0d492ad9ee0ec35aab1f104", size = 24546 },
{ url = "https://files.pythonhosted.org/packages/1b/d0/397f9626e711ff749a95d96b7af99b9c566a9bb5129b8e4c10fc4d100304/python_multipart-0.0.22-py3-none-any.whl", hash = "sha256:2b2cd894c83d21bf49d702499531c7bafd057d730c201782048f7945d82de155", size = 24579 },
]
[[package]]