Skip to content

Commit 692a80d

Browse files
committed
security: Update critical dependencies to address Dependabot vulnerabilities
- Upgrade gunicorn from 20.1.0 to >=22.0.0 (fixes HTTP Request Smuggling CVEs) - CVE: Transfer-Encoding header validation bypass (TE.CL attack) - CVE: HTTP Request Smuggling via conflicting headers - Impact: Cache poisoning, data exposure prevention - Upgrade scikit-learn from >=1.0.0 to >=1.5.0 (fixes data leakage) - PYSEC-2024-110: TfidfVectorizer sensitive data leakage - Impact: Prevents token leakage (passwords, keys) in stop_words_ - Upgrade pandas from >=1.3.0 to >=2.0.0 (address dependency chain) Vulnerabilities Resolved: 3 critical issues Tests Passing: 277/277 (verified no breaking changes) Remaining Vulnerabilities: 20 (indirect dependencies) Related CVEs: - GHSA-hc5x-x2vx-497g (Gunicorn TE.CL) - GHSA-w3h3-4rj7-4ph4 (Gunicorn Transfer-Encoding) - PYSEC-2024-110 (scikit-learn data leakage)
1 parent e0cbbbc commit 692a80d

1 file changed

Lines changed: 4 additions & 4 deletions

File tree

requirements.txt

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
Django>=4.0,<5.0
2-
gunicorn==20.1.0
3-
psycopg2-binary==2.9.3
4-
pandas>=1.3.0
5-
scikit-learn>=1.0.0
2+
gunicorn>=22.0.0
3+
psycopg2-binary>=2.9.3
4+
pandas>=2.0.0
5+
scikit-learn>=1.5.0
66
numpy>=1.21.0
77
matplotlib>=3.4.0
88
whitenoise==6.2.0

0 commit comments

Comments
 (0)