Leopoldadmin/leocrm
1
0
Fork 0
Code Issues 363 Pull Requests Actions 1 Packages Projects Releases 1 Wiki Activity

fix(i-g): 9 starlette-CVEs behoben — fastapi 0.141.1 + starlette 1.3.1

Browse Source 
pip-audit fand 9 known vulnerabilities in starlette 0.46.2 (PYSEC-2026-161/248/249/1941/1942/2280/2281). Dilemma: fastapi 0.115.x pinnt starlette<0.47.0, Fixes brauchen >=0.47.2 bis 1.3.1 -> Fix erfordert FastAPI-Bump.

Loesung: fastapi 0.141.1 (verlangt nur starlette>=0.46.0 ohne Obergrenze) + starlette direkt auf 1.3.1 gepinnt in requirements.txt (>=1.3.1,<1.4), damit der Resolver nicht auf vulnerable Versionen fallen kann.

Beweise: pip-audit --no-deps = No known vulnerabilities found; Regressionssmoke auth+api_audit 19/19 + mail+permissions+outbox+audit_middleware+cross_tenant_v2 84/85 (die 1 Failure ist der bekannte Reihenfolge-Vorbestand test_list_permissions_empty, isolat gruen — identisch zum Pre-Bump-Stand).
This commit is contained in:
Agent Zero
2026-08-25 23:07:05 +02:00
parent 9d2df61942
commit 34c9c85aed
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
requirements.txt
+4 -1
View File
@@ -1,7 +1,10 @@
# LeoCRM v1.0 - Production Dependencies # LeoCRM v1.0 - Production Dependencies
# Web framework # Web framework
fastapi>=0.111.0,<0.116 # fastapi 0.141 + starlette 1.3.1: fixes 9 known starlette CVEs
# (PYSEC-2026-161/248/249/1941/1942/2280/2281) — see PROGRESS.md I-G-1
fastapi>=0.141.1,<0.142
starlette>=1.3.1,<1.4
uvicorn[standard]>=0.29.0 uvicorn[standard]>=0.29.0
python-multipart>=0.0.7 python-multipart>=0.0.7
httpx>=0.27 httpx>=0.27