marvin8/cang
Watch
1
0
Fork
You've already forked cang
 0
Code Issues 1 Pull requests Releases 28 Activity Actions

Fix transitive dependency vulnerabilities: starlette, python-multipart, pydantic-settings #94

New issue
Closed
opened 2026-06-21 09:50:31 +00:00 by coding-agent-marvin8 · 2 comments
coding-agent-marvin8 commented 2026-06-21 09:50:31 +00:00 (Migrated from codeberg.org)
Copy link

pysentry reports 7 vulnerabilities across 3 packages:

  • python-multipart 0.0.29 — HIGH: quadratic CPU DoS in QuerystringParser (GHSA-5rvq-cxj2-64vf); HIGH: negative Content-Length unbounded read (GHSA-r589-f936-vvph); two LOW-severity issues. Fix: 0.0.31+
  • starlette 1.1.0 — HIGH: form parsing limits ignored for url-encoded bodies (GHSA-82w8-qh3p-5jfq); LOW: path-based URL authority spoofing (GHSA-jp82-jpqv-5vv3). Fix: 1.3.0+
  • pydantic-settings 2.14.1 — one vulnerability. Fix: 2.14.2+

All three are transitive deps pulled in via fastapi[standard]. starlette is additionally pinned as a uv constraint-dependency.

pysentry reports 7 vulnerabilities across 3 packages: - **python-multipart 0.0.29** — HIGH: quadratic CPU DoS in QuerystringParser (GHSA-5rvq-cxj2-64vf); HIGH: negative Content-Length unbounded read (GHSA-r589-f936-vvph); two LOW-severity issues. Fix: 0.0.31+ - **starlette 1.1.0** — HIGH: form parsing limits ignored for url-encoded bodies (GHSA-82w8-qh3p-5jfq); LOW: path-based URL authority spoofing (GHSA-jp82-jpqv-5vv3). Fix: 1.3.0+ - **pydantic-settings 2.14.1** — one vulnerability. Fix: 2.14.2+ All three are transitive deps pulled in via fastapi[standard]. starlette is additionally pinned as a uv constraint-dependency.
coding-agent-marvin8 commented 2026-06-21 09:51:05 +00:00 (Migrated from codeberg.org)
Copy link

Plan:

  • Tighten the entry in from to
  • Add and to the same constraint block
  • Run uv lock --upgrade-package starlette --upgrade-package python-multipart --upgrade-package pydantic-settings to resolve new minimums
  • Regenerate pylock.toml
  • Re-run nox -s pysentry to confirm clean

Branch: fix/vuln-dep-constraints
Commit: :lock: fix: tighten constraint-dependencies to resolve pysentry vulnerabilities

**Plan:** - Tighten the entry in from to - Add and to the same constraint block - Run `uv lock --upgrade-package starlette --upgrade-package python-multipart --upgrade-package pydantic-settings` to resolve new minimums - Regenerate `pylock.toml` - Re-run `nox -s pysentry` to confirm clean Branch: `fix/vuln-dep-constraints` Commit: `:lock: fix: tighten constraint-dependencies to resolve pysentry vulnerabilities`
coding-agent-marvin8 commented 2026-06-21 09:52:21 +00:00 (Migrated from codeberg.org)
Copy link

Plan:

  • Tighten the starlette entry in [tool.uv].constraint-dependencies from >=1.0.1 to >=1.3.0
  • Add python-multipart>=0.0.31 and pydantic-settings>=2.14.2 to the same constraint block
  • Run uv lock --upgrade-package starlette --upgrade-package python-multipart --upgrade-package pydantic-settings to resolve new minimums
  • Regenerate pylock.toml
  • Re-run nox -s pysentry to confirm clean

Branch: fix/vuln-dep-constraints
Commit: :lock: fix: tighten constraint-dependencies to resolve pysentry vulnerabilities

**Plan:** - Tighten the `starlette` entry in `[tool.uv].constraint-dependencies` from `>=1.0.1` to `>=1.3.0` - Add `python-multipart>=0.0.31` and `pydantic-settings>=2.14.2` to the same constraint block - Run `uv lock --upgrade-package starlette --upgrade-package python-multipart --upgrade-package pydantic-settings` to resolve new minimums - Regenerate `pylock.toml` - Re-run `nox -s pysentry` to confirm clean Branch: `fix/vuln-dep-constraints` Commit: `:lock: fix: tighten constraint-dependencies to resolve pysentry vulnerabilities`
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
pages
2026.8.4
2026.7.25
2026.7.24
2026.7.23
2026.7.22
0.10.1
0.10.0
0.9.0
0.8.0
0.7.0
0.6.0
0.5.0
0.4.2
0.4.1
0.4.0
0.3.12
0.3.11
0.3.10
0.3.9
0.3.8
0.3.7
0.3.6
0.3.5
0.3.4
0.3.3
0.3.2
0.3.1
0.3.0
0.2.0
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
marvin8/cang#94
No description provided.