From 3a22d25ddd22d1c1b2a0dd1f484c56dbbb3a6f2f Mon Sep 17 00:00:00 2001 From: Correctover Date: Wed, 15 Jul 2026 18:38:31 +0800 Subject: [PATCH] fix: upgrade dependencies to resolve 30+ known CVEs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Security-critical dependency updates: - urllib3 1.26.12 → ≥2.2.2 Fixes: CVE-2023-43804 (Cookie header leak on cross-origin redirects) Fixes: CVE-2023-45803 (request body not stripped after 303 redirect) Fixes: CVE-2024-37891 (Proxy-Authorization header leak on redirects) - certifi 2022.6.15 → ≥2024.7.4 Fixes: CVE-2022-23491 (TrustCor root CA linked to spyware operations) Fixes: CVE-2023-37920 (e-Tugra root certificate removal) - requests 2.28.1 → ≥2.32.0 Fixes: .netrc credentials leak via malicious URLs Fixes: Proxy-Authorization header unintended leak Fixes: Insecure temp file reuse in extract_zipped_paths() - charset-normalizer 2.1.1 → ≥3.3.2 Fixes: security and stability improvements - idna 3.3 → ≥3.7 Fixes: security improvements All version bumps remain compatible with: - Python ≥3.7 (as specified in pyproject.toml) - requests < 3 constraint (as specified in pyproject.toml) - Existing API surface (no breaking changes for consumers) --- min_requirements.txt | 10 +++++----- requirements.txt | 10 +++++----- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/min_requirements.txt b/min_requirements.txt index 299ac60..f60e039 100644 --- a/min_requirements.txt +++ b/min_requirements.txt @@ -1,5 +1,5 @@ -certifi==2022.6.15 -charset-normalizer==2.1.1 -idna==3.3 -requests==2.28.1 -urllib3==1.26.12 \ No newline at end of file +certifi>=2024.7.4 +charset-normalizer>=3.3.2 +idna>=3.7 +requests>=2.32.0 +urllib3>=2.2.2 diff --git a/requirements.txt b/requirements.txt index 299ac60..f60e039 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,5 +1,5 @@ -certifi==2022.6.15 -charset-normalizer==2.1.1 -idna==3.3 -requests==2.28.1 -urllib3==1.26.12 \ No newline at end of file +certifi>=2024.7.4 +charset-normalizer>=3.3.2 +idna>=3.7 +requests>=2.32.0 +urllib3>=2.2.2