Agent Zero
34c9c85aed
pip-audit fand 9 known vulnerabilities in starlette 0.46.2 (PYSEC-2026-161/248/249/1941/1942/2280/2281). Dilemma: fastapi 0.115.x pinnt starlette<0.47.0, Fixes brauchen >=0.47.2 bis 1.3.1 -> Fix erfordert FastAPI-Bump. Loesung: fastapi 0.141.1 (verlangt nur starlette>=0.46.0 ohne Obergrenze) + starlette direkt auf 1.3.1 gepinnt in requirements.txt (>=1.3.1,<1.4), damit der Resolver nicht auf vulnerable Versionen fallen kann. Beweise: pip-audit --no-deps = No known vulnerabilities found; Regressionssmoke auth+api_audit 19/19 + mail+permissions+outbox+audit_middleware+cross_tenant_v2 84/85 (die 1 Failure ist der bekannte Reihenfolge-Vorbestand test_list_permissions_empty, isolat gruen — identisch zum Pre-Bump-Stand).
62 lines
951 B
Plaintext
62 lines
951 B
Plaintext
# LeoCRM v1.0 - Production Dependencies
|
|
|
|
# Web framework
|
|
# fastapi 0.141 + starlette 1.3.1: fixes 9 known starlette CVEs
|
|
# (PYSEC-2026-161/248/249/1941/1942/2280/2281) — see PROGRESS.md I-G-1
|
|
fastapi>=0.141.1,<0.142
|
|
starlette>=1.3.1,<1.4
|
|
uvicorn[standard]>=0.29.0
|
|
python-multipart>=0.0.7
|
|
httpx>=0.27
|
|
|
|
# Database / ORM
|
|
sqlalchemy==2.0.35
|
|
alembic>=1.13
|
|
asyncpg>=0.29
|
|
|
|
# Validation / Settings
|
|
pydantic>=2.5
|
|
pydantic-settings>=2.1
|
|
email-validator>=2.0
|
|
|
|
# Auth
|
|
passlib[bcrypt]==1.7.4
|
|
bcrypt==4.0.1
|
|
cryptography>=42.0
|
|
|
|
# Redis / Job Queue
|
|
redis>=5.0
|
|
arq>=0.25
|
|
croniter>=2.0
|
|
|
|
# File I/O
|
|
aiofiles>=23.2
|
|
|
|
# Email (IMAP/SMTP)
|
|
aioimaplib>=1.0
|
|
aiosmtplib>=3.0
|
|
pgpy>=0.6
|
|
|
|
# HTML sanitization
|
|
nh3>=0.2
|
|
|
|
# Templates (optional)
|
|
jinja2>=3.1
|
|
greenlet>=3.0
|
|
openpyxl>=3.1
|
|
|
|
# PDF generation
|
|
weasyprint>=62.0
|
|
|
|
# Monitoring
|
|
prometheus-client>=0.20
|
|
structlog>=24.0
|
|
litellm>=1.0,<2.0
|
|
|
|
# AI / Search
|
|
pgvector>=0.3.0
|
|
pypdf>=1.24.0
|
|
python-docx>=1.1.0
|
|
python-pptx>=0.6.23
|
|
minio
|