diff --git a/hindsight-api-slim/pyproject.toml b/hindsight-api-slim/pyproject.toml index 916c496f..32336b84 100644 --- a/hindsight-api-slim/pyproject.toml +++ b/hindsight-api-slim/pyproject.toml @@ -57,6 +57,7 @@ dependencies = [ "authlib>=1.6.9", # Account takeover/JWS header injection vulnerability fix "pyjwt>=2.12.0", # Accepts unknown crit header extensions fix "orjson>=3.11.6", # Unbounded recursion DoS fix + "python-multipart>=0.0.22", # Arbitrary file write via non-default configuration fix "tornado>=6.5.5", # DoS multipart/incomplete cookie validation fix "aiohttp>=3.13.3", # Multiple DoS vulnerabilities "claude-agent-sdk>=0.1.27", diff --git a/hindsight-integrations/crewai/pyproject.toml b/hindsight-integrations/crewai/pyproject.toml index c5f75b40..6f6363a7 100644 --- a/hindsight-integrations/crewai/pyproject.toml +++ b/hindsight-integrations/crewai/pyproject.toml @@ -33,6 +33,7 @@ dependencies = [ "cryptography>=46.0.5", # Subgroup attack vulnerability fix "pillow>=12.1.1", # Out-of-bounds write in PSD image loading fix "pyjwt>=2.12.0", # Accepts unknown crit header extensions fix + "requests>=2.33.0", # Insecure temp file reuse in extract_zipped_paths() ] [project.optional-dependencies] diff --git a/hindsight-integrations/crewai/uv.lock b/hindsight-integrations/crewai/uv.lock index e4590d8e..55215501 100644 --- a/hindsight-integrations/crewai/uv.lock +++ b/hindsight-integrations/crewai/uv.lock @@ -1,5 +1,4 @@ version = 1 -revision = 1 requires-python = ">=3.10" resolution-markers = [ "python_full_version >= '3.13'", @@ -1018,6 +1017,7 @@ dependencies = [ { name = "hindsight-client" }, { name = "pillow" }, { name = "pyjwt" }, + { name = "requests" }, ] [package.optional-dependencies] @@ -1040,8 +1040,8 @@ requires-dist = [ { name = "pyjwt", specifier = ">=2.12.0" }, { name = "pytest", marker = "extra == 'dev'", specifier = ">=7.0.0" }, { name = "pytest-mock", marker = "extra == 'dev'", specifier = ">=3.10.0" }, + { name = "requests", specifier = ">=2.33.0" }, ] -provides-extras = ["dev"] [package.metadata.requires-dev] dev = [{ name = "pytest", specifier = ">=9.0.2" }] @@ -3116,7 +3116,7 @@ wheels = [ [[package]] name = "requests" -version = "2.32.5" +version = "2.33.0" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "certifi" }, @@ -3124,9 +3124,9 @@ dependencies = [ { name = "idna" }, { name = "urllib3" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/c9/74/b3ff8e6c8446842c3f5c837e9c3dfcfe2018ea6ecef224c710c85ef728f4/requests-2.32.5.tar.gz", hash = "sha256:dbba0bac56e100853db0ea71b82b4dfd5fe2bf6d3754a8893c3af500cec7d7cf", size = 134517 } +sdist = { url = "https://files.pythonhosted.org/packages/34/64/8860370b167a9721e8956ae116825caff829224fbca0ca6e7bf8ddef8430/requests-2.33.0.tar.gz", hash = "sha256:c7ebc5e8b0f21837386ad0e1c8fe8b829fa5f544d8df3b2253bff14ef29d7652", size = 134232 } wheels = [ - { url = "https://files.pythonhosted.org/packages/1e/db/4254e3eabe8020b458f1a747140d32277ec7a271daf1d235b70dc0b4e6e3/requests-2.32.5-py3-none-any.whl", hash = "sha256:2462f94637a34fd532264295e186976db0f5d453d1cdd31473c85a6a161affb6", size = 64738 }, + { url = "https://files.pythonhosted.org/packages/56/5d/c814546c2333ceea4ba42262d8c4d55763003e767fa169adc693bd524478/requests-2.33.0-py3-none-any.whl", hash = "sha256:3324635456fa185245e24865e810cecec7b4caf933d7eb133dcde67d48cee69b", size = 65017 }, ] [[package]] diff --git a/hindsight-integrations/langgraph/pyproject.toml b/hindsight-integrations/langgraph/pyproject.toml index d1a1b4cc..70a50392 100644 --- a/hindsight-integrations/langgraph/pyproject.toml +++ b/hindsight-integrations/langgraph/pyproject.toml @@ -30,6 +30,8 @@ classifiers = [ dependencies = [ "langchain-core>=0.3.0", "hindsight-client>=0.4.0", + # Transitive dependency security fixes + "requests>=2.33.0", # Insecure temp file reuse in extract_zipped_paths() ] [project.optional-dependencies] diff --git a/hindsight-integrations/langgraph/uv.lock b/hindsight-integrations/langgraph/uv.lock index a96d6b43..2909a4f2 100644 --- a/hindsight-integrations/langgraph/uv.lock +++ b/hindsight-integrations/langgraph/uv.lock @@ -1,5 +1,4 @@ version = 1 -revision = 1 requires-python = ">=3.10" [[package]] @@ -490,11 +489,12 @@ wheels = [ [[package]] name = "hindsight-langgraph" -version = "0.1.0" +version = "0.1.1" source = { editable = "." } dependencies = [ { name = "hindsight-client" }, { name = "langchain-core" }, + { name = "requests" }, ] [package.optional-dependencies] @@ -516,10 +516,10 @@ dev = [ requires-dist = [ { name = "hindsight-client", specifier = ">=0.4.0" }, { name = "langchain-core", specifier = ">=0.3.0" }, - { name = "langgraph", marker = "extra == 'all'", specifier = ">=0.5.0" }, - { name = "langgraph", marker = "extra == 'langgraph'", specifier = ">=0.5.0" }, + { name = "langgraph", marker = "extra == 'all'", specifier = ">=0.3.0" }, + { name = "langgraph", marker = "extra == 'langgraph'", specifier = ">=0.3.0" }, + { name = "requests", specifier = ">=2.33.0" }, ] -provides-extras = ["langgraph", "all"] [package.metadata.requires-dev] dev = [ @@ -1349,7 +1349,7 @@ wheels = [ [[package]] name = "requests" -version = "2.32.5" +version = "2.33.0" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "certifi" }, @@ -1357,9 +1357,9 @@ dependencies = [ { name = "idna" }, { name = "urllib3" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/c9/74/b3ff8e6c8446842c3f5c837e9c3dfcfe2018ea6ecef224c710c85ef728f4/requests-2.32.5.tar.gz", hash = "sha256:dbba0bac56e100853db0ea71b82b4dfd5fe2bf6d3754a8893c3af500cec7d7cf", size = 134517 } +sdist = { url = "https://files.pythonhosted.org/packages/34/64/8860370b167a9721e8956ae116825caff829224fbca0ca6e7bf8ddef8430/requests-2.33.0.tar.gz", hash = "sha256:c7ebc5e8b0f21837386ad0e1c8fe8b829fa5f544d8df3b2253bff14ef29d7652", size = 134232 } wheels = [ - { url = "https://files.pythonhosted.org/packages/1e/db/4254e3eabe8020b458f1a747140d32277ec7a271daf1d235b70dc0b4e6e3/requests-2.32.5-py3-none-any.whl", hash = "sha256:2462f94637a34fd532264295e186976db0f5d453d1cdd31473c85a6a161affb6", size = 64738 }, + { url = "https://files.pythonhosted.org/packages/56/5d/c814546c2333ceea4ba42262d8c4d55763003e767fa169adc693bd524478/requests-2.33.0-py3-none-any.whl", hash = "sha256:3324635456fa185245e24865e810cecec7b4caf933d7eb133dcde67d48cee69b", size = 65017 }, ] [[package]] diff --git a/hindsight-integrations/litellm/pyproject.toml b/hindsight-integrations/litellm/pyproject.toml index a43dd987..f615500a 100644 --- a/hindsight-integrations/litellm/pyproject.toml +++ b/hindsight-integrations/litellm/pyproject.toml @@ -37,6 +37,7 @@ dependencies = [ "aiohttp>=3.13.3", # Multiple DoS vulnerabilities "filelock>=3.20.3", # TOCTOU race condition "urllib3>=2.6.3", # Decompression-bomb safeguards bypass + "requests>=2.33.0", # Insecure temp file reuse in extract_zipped_paths() ] [project.optional-dependencies] diff --git a/hindsight-integrations/litellm/uv.lock b/hindsight-integrations/litellm/uv.lock index e229fc41..79c14912 100644 --- a/hindsight-integrations/litellm/uv.lock +++ b/hindsight-integrations/litellm/uv.lock @@ -1,5 +1,4 @@ version = 1 -revision = 1 requires-python = ">=3.10" resolution-markers = [ "python_full_version >= '3.14'", @@ -691,12 +690,13 @@ wheels = [ [[package]] name = "hindsight-litellm" -version = "0.4.19" +version = "0.5.0" source = { editable = "." } dependencies = [ { name = "aiohttp" }, { name = "filelock" }, { name = "litellm" }, + { name = "requests" }, { name = "urllib3" }, ] @@ -716,13 +716,13 @@ dev = [ requires-dist = [ { name = "aiohttp", specifier = ">=3.13.3" }, { name = "filelock", specifier = ">=3.20.3" }, - { name = "litellm", specifier = ">=1.40.0" }, + { name = "litellm", specifier = ">=1.40.0,<=1.82.6" }, { name = "pytest", marker = "extra == 'dev'", specifier = ">=7.0.0" }, { name = "pytest-asyncio", marker = "extra == 'dev'", specifier = ">=0.21.0" }, { name = "pytest-mock", marker = "extra == 'dev'", specifier = ">=3.10.0" }, + { name = "requests", specifier = ">=2.33.0" }, { name = "urllib3", specifier = ">=2.6.3" }, ] -provides-extras = ["dev"] [package.metadata.requires-dev] dev = [{ name = "pytest", specifier = ">=9.0.2" }] @@ -1723,7 +1723,7 @@ wheels = [ [[package]] name = "requests" -version = "2.32.5" +version = "2.33.0" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "certifi" }, @@ -1731,9 +1731,9 @@ dependencies = [ { name = "idna" }, { name = "urllib3" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/c9/74/b3ff8e6c8446842c3f5c837e9c3dfcfe2018ea6ecef224c710c85ef728f4/requests-2.32.5.tar.gz", hash = "sha256:dbba0bac56e100853db0ea71b82b4dfd5fe2bf6d3754a8893c3af500cec7d7cf", size = 134517 } +sdist = { url = "https://files.pythonhosted.org/packages/34/64/8860370b167a9721e8956ae116825caff829224fbca0ca6e7bf8ddef8430/requests-2.33.0.tar.gz", hash = "sha256:c7ebc5e8b0f21837386ad0e1c8fe8b829fa5f544d8df3b2253bff14ef29d7652", size = 134232 } wheels = [ - { url = "https://files.pythonhosted.org/packages/1e/db/4254e3eabe8020b458f1a747140d32277ec7a271daf1d235b70dc0b4e6e3/requests-2.32.5-py3-none-any.whl", hash = "sha256:2462f94637a34fd532264295e186976db0f5d453d1cdd31473c85a6a161affb6", size = 64738 }, + { url = "https://files.pythonhosted.org/packages/56/5d/c814546c2333ceea4ba42262d8c4d55763003e767fa169adc693bd524478/requests-2.33.0-py3-none-any.whl", hash = "sha256:3324635456fa185245e24865e810cecec7b4caf933d7eb133dcde67d48cee69b", size = 65017 }, ] [[package]] diff --git a/uv.lock b/uv.lock index 9888b612..a69cf279 100644 --- a/uv.lock +++ b/uv.lock @@ -1568,6 +1568,7 @@ dependencies = [ { name = "pyjwt", extra = ["crypto"] }, { name = "python-dateutil" }, { name = "python-dotenv" }, + { name = "python-multipart" }, { name = "rich" }, { name = "sqlalchemy" }, { name = "tiktoken" }, @@ -1683,6 +1684,7 @@ requires-dist = [ { name = "pytest-xdist", marker = "extra == 'test'", specifier = ">=3.0.0" }, { name = "python-dateutil", specifier = ">=2.8.0" }, { name = "python-dotenv", specifier = ">=1.0.0" }, + { name = "python-multipart", specifier = ">=0.0.22" }, { name = "rich", specifier = ">=13.0.0" }, { name = "safetensors", marker = "extra == 'local-ml'", specifier = ">=0.6.2" }, { name = "sentence-transformers", marker = "extra == 'local-ml'", specifier = ">=3.3.0" }, @@ -4180,11 +4182,11 @@ wheels = [ [[package]] name = "python-multipart" -version = "0.0.20" +version = "0.0.22" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/f3/87/f44d7c9f274c7ee665a29b885ec97089ec5dc034c7f3fafa03da9e39a09e/python_multipart-0.0.20.tar.gz", hash = "sha256:8dd0cab45b8e23064ae09147625994d090fa46f5b0d1e13af944c331a7fa9d13", size = 37158 } +sdist = { url = "https://files.pythonhosted.org/packages/94/01/979e98d542a70714b0cb2b6728ed0b7c46792b695e3eaec3e20711271ca3/python_multipart-0.0.22.tar.gz", hash = "sha256:7340bef99a7e0032613f56dc36027b959fd3b30a787ed62d310e951f7c3a3a58", size = 37612 } wheels = [ - { url = "https://files.pythonhosted.org/packages/45/58/38b5afbc1a800eeea951b9285d3912613f2603bdf897a4ab0f4bd7f405fc/python_multipart-0.0.20-py3-none-any.whl", hash = "sha256:8a62d3a8335e06589fe01f2a3e178cdcc632f3fbe0d492ad9ee0ec35aab1f104", size = 24546 }, + { url = "https://files.pythonhosted.org/packages/1b/d0/397f9626e711ff749a95d96b7af99b9c566a9bb5129b8e4c10fc4d100304/python_multipart-0.0.22-py3-none-any.whl", hash = "sha256:2b2cd894c83d21bf49d702499531c7bafd057d730c201782048f7945d82de155", size = 24579 }, ] [[package]]