chore(deps): security upgrade — patch 36 transitive CVEs#159
Conversation
Adds direct version pins for 7 transitive packages to mitigate 36 Trivy- reported CVEs across the application. All 36 CVEs were assessed as unreachable in this codebase via static analysis (max EPSS 0.42%). Packages upgraded: - h11 0.14.0 -> 0.16.0 (1 CVE) - aiohttp 3.11.11 -> 3.14.1 (21 CVEs) - urllib3 2.3.0 -> 2.7.0 (6 CVEs) - protobuf 5.29.3 -> 6.33.6 (2 CVEs) - starlette 0.36.3 -> 1.3.0 (3 CVEs, required fastapi bump) - requests 2.32.3 -> 2.34.2 (2 CVEs) - idna 3.10 -> 3.18 (1 CVE) Knock-on framework bumps (required to unblock the security pins): - fastapi 0.109.2 -> 0.136.3 (pin was '==0.109.2', now '>=0.133.0') - httpx 0.23.3 -> 0.28.1 (pin was '<0.24.0', widened to '>=0.27.0') - httpcore 0.16.3 -> 1.0.9 Test fix: webhook HMAC test re-encoded the body via httpx, which uses compact JSON separators in 0.28. Test now signs the exact bytes it sends. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Docker ImagesCommit:
|
📦 h11: 0.14.0 → 0.16.0
CVEs resolved (1)
Notable changes
Codebase consumption
Reachability analysisNot reachable. CVE-2025-43859 affects HTTP/1.1 servers that parse incoming requests with malformed chunked encoding. We use h11 only as a client (via httpx) to make outbound requests to GitHub and Slack. h11's client-side parser path is not vulnerable. Our application's server is FastAPI/Starlette, which uses its own HTTP/1.1 parser via uvicorn — not h11. |
📦 urllib3: 2.3.0 → 2.7.0
CVEs resolved (6)
Notable changes
Codebase consumption
Reachability analysisNot reachable. The decompression-bomb and streaming-read CVEs require |
📦 aiohttp: 3.11.11 → 3.14.1
CVEs resolved (21)High: CVE-2025-69223 (zip-bomb via auto_decompress) Mostly server-side: DoS via multipart/headers/cookies, header injection, request smuggling, static-file path issues, CookieJar deserialization. Client-side: cross-origin cookie leakage, retained auth headers on redirect. Notable changes
Codebase consumption
Reachability analysisNot reachable. No |
📦 starlette: 0.36.3 → 1.3.0 (MAJOR)
CVEs resolved (3)
Notable changes
Codebase consumption
Lifespan/decorators: Reachability analysisNot reachable.
This bump also unblocks the security pins for fastapi ( |
📦 protobuf: 5.29.3 → 6.33.6 (MAJOR)
CVEs resolved (2)
Notable changes
Codebase consumption
Reachability analysisNot reachable. Both CVEs require parsing untrusted protobuf input. We only serialize protobuf for OTLP trace/log/metric export — the messages we encode are built from our own application data, then handed to the OTLP exporter for transmission to a trusted internal collector. We never parse incoming protobuf messages from user input. The OTLP exporter itself doesn't expose |
📦 requests: 2.32.3 → 2.34.2
CVEs resolved (2)
Notable changes
Codebase consumption
Reachability analysisNot reachable.
|
📦 idna: 3.10 → 3.18
CVEs resolved (1)
Notable changes
Codebase consumption
Reachability analysisNot reachable. CVE-2026-45409 requires an attacker-controlled domain name (or hostname-like input) to be IDNA-encoded. All httpx targets in our code use hard-coded URLs (GitHub API, Slack API). The K8s API endpoint comes from KUBECONFIG, not user input. No webhook payload field becomes a hostname. |
1 participant
Summary
Mitigates 36 transitive CVEs flagged by Trivy across 7 Python dependencies by adding direct version pins in
pyproject.toml. All 36 CVEs were assessed as unreachable in this codebase via static analysis (max EPSS 0.42%).Two scanners were used to cross-reference findings:
After upgrade, the same Trivy scan returns 0 vulnerabilities in
uv.lock.Library Summary
Framework bumps required to unblock security pins
==0.109.2pinned starlette<0.37; needed>=0.133.0to allow starlette 1.x<0.24.0pinned httpcore<0.17which capped h11 at<0.15; needed>=0.27.0CVE Summary
36 CVEs addressed (click to expand)
Risk Assessment Methodology
Each CVE was scored using a composite of:
Revised risk lowered from scanner default for findings where the affected functionality is unreachable AND EPSS is low. See per-package PR comments for the reachability rationale per package.
The patterns that prevent exploitation across all 36 CVEs:
aiohttp.webserver (FastAPI/Starlette is the server)stream=True/preload_content=False).netrcusage; noTrustedHostMiddlewareTest plan
uv lockresolves cleanlyuv sync --all-extrasinstalls successfullyuv run pytest— 44 passed, 3 pre-existing failures intests/test_git.py(unrelated:git checkout mainfails because test repo has nomainbranch)trivy fs --scanners vuln --pkg-types library uv.lock— 0 findings (was 36)/livez,/readyz) confirmed under fastapi 0.136Notes
tests/test_gitops_server.py::test_webhook_returns_200_if_hmac_is_correct. httpx 0.28 changed default JSON serialization to compact form (no whitespace), which caused HMAC mismatch between the test'sjson.dumps(...)body and what httpx serialized. Fix: encode the body once, pass as rawcontent=and HMAC the same bytes.protobuf5→6,starlette0→1,httpcore0→1,fastapi0.109→0.136): functional regressions are unlikely as our usage is narrow, but reviewers should manually verify webhook flow and OTLP export in staging before merging.🤖 Generated with Claude Code