From db25dd00f569482d112b2288bd1f0e0342be4321 Mon Sep 17 00:00:00 2001 From: wencheng-888 Date: Wed, 12 Aug 2026 18:25:41 +0800 Subject: [PATCH] fix: update vulnerable Python dependencies --- backend_api_python/requirements.lock | 6 +++--- backend_api_python/requirements.txt | 6 ++++-- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/backend_api_python/requirements.lock b/backend_api_python/requirements.lock index 361ec3bac..5853f7953 100644 --- a/backend_api_python/requirements.lock +++ b/backend_api_python/requirements.lock @@ -1,7 +1,7 @@ # Generated from requirements.txt for the verified Python 3.12 Linux production image. # Regenerate and validate this file whenever direct production requirements change. aiohappyeyeballs==2.7.1 -aiohttp==3.14.1 +aiohttp==3.14.3 aiohttp-fast-zlib==0.3.0 aiosignal==1.4.0 akracer==0.0.14 @@ -27,7 +27,7 @@ click-didyoumean==0.3.1 click-plugins==1.1.1.2 click-repl==0.3.0 coincurve==21.0.0 -cryptography==49.0.0 +cryptography==50.0.0 curl-cffi==0.15.0 decorator==5.3.1 distro==1.9.0 @@ -92,7 +92,7 @@ pygments==2.20.0 pyjwt==2.13.0 pyluach==2.3.0 pyotp==2.10.0 -pypdf==6.14.2 +pypdf==6.15.0 pyproject-hooks==1.2.0 pysocks==1.7.1 python-dateutil==2.9.0.post0 diff --git a/backend_api_python/requirements.txt b/backend_api_python/requirements.txt index c1d0bb130..fb06674b6 100644 --- a/backend_api_python/requirements.txt +++ b/backend_api_python/requirements.txt @@ -20,7 +20,8 @@ akshare>=1.18.80 # GHSA-752w-5fwx-jx9f (crit header); 2.12.0+ PyJWT>=2.13.0,<3 python-dotenv>=1.2.2 -cryptography>=49.0.0 +# PYSEC-2026-3552; 50.0.0+ +cryptography>=50.0.0 # TOTP MFA and QR code generation pyotp>=2.10.0 qrcode[pil]>=8.2 @@ -41,7 +42,8 @@ flask-smorest>=0.47.0,<0.48 marshmallow>=4.3.0,<5 PyYAML>=6.0.3 # Server-side PDF export for AI analysis reports -pypdf>=6.14.2,<7 +# PYSEC-2026-3655 / PYSEC-2026-3656; 6.15.0+ +pypdf>=6.15.0,<7 reportlab>=5.0.0 # Password hashing bcrypt>=5.0.0