From 34c9c85aedc3a060f90b7c4e7fcdff07826dbb8c Mon Sep 17 00:00:00 2001 From: Agent Zero Date: Tue, 25 Aug 2026 23:07:05 +0200 Subject: [PATCH] =?UTF-8?q?fix(i-g):=209=20starlette-CVEs=20behoben=20?= =?UTF-8?q?=E2=80=94=20fastapi=200.141.1=20+=20starlette=201.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit pip-audit fand 9 known vulnerabilities in starlette 0.46.2 (PYSEC-2026-161/248/249/1941/1942/2280/2281). Dilemma: fastapi 0.115.x pinnt starlette<0.47.0, Fixes brauchen >=0.47.2 bis 1.3.1 -> Fix erfordert FastAPI-Bump. Loesung: fastapi 0.141.1 (verlangt nur starlette>=0.46.0 ohne Obergrenze) + starlette direkt auf 1.3.1 gepinnt in requirements.txt (>=1.3.1,<1.4), damit der Resolver nicht auf vulnerable Versionen fallen kann. Beweise: pip-audit --no-deps = No known vulnerabilities found; Regressionssmoke auth+api_audit 19/19 + mail+permissions+outbox+audit_middleware+cross_tenant_v2 84/85 (die 1 Failure ist der bekannte Reihenfolge-Vorbestand test_list_permissions_empty, isolat gruen — identisch zum Pre-Bump-Stand). --- requirements.txt | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 45f8201..a53082d 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,7 +1,10 @@ # LeoCRM v1.0 - Production Dependencies # Web framework -fastapi>=0.111.0,<0.116 +# fastapi 0.141 + starlette 1.3.1: fixes 9 known starlette CVEs +# (PYSEC-2026-161/248/249/1941/1942/2280/2281) — see PROGRESS.md I-G-1 +fastapi>=0.141.1,<0.142 +starlette>=1.3.1,<1.4 uvicorn[standard]>=0.29.0 python-multipart>=0.0.7 httpx>=0.27