31853ab2b8
Python (apps/api): - cryptography 48.0.1 -> 50.0.0 (PKCS#7 Bleichenbacher oracle, high) npm (pnpm-workspace.yaml catalog/overrides + lockfile): - react-router 7.15.1 -> 7.18.1, @react-router/dev -> 7.17.0, @react-router/node/serve -> 7.18.1 (DoS, open redirect, XSS, constructor injection) - sharp ^0.34.3 -> ^0.35.3 (libvips CVEs, high) - fast-uri -> 3.1.5 via override (host confusion, high) - js-yaml -> 4.3.0 via override (quadratic CPU DoS, high) - linkify-it -> 5.0.2 via override (mailto validator DoS, high) - postcss 8.5.15 -> 8.5.25 (source map path traversal, high/medium) - undici -> 7.29.0 via override (info disclosure, CRLF/cookie injection) - sanitize-html 2.17.0 -> 2.17.5 (URI scheme validation bypass, medium) - valibot -> 1.4.2 via override (flatten() throw, medium) - body-parser -> 1.20.6 via override (limit bypass DoS, low)
77 lines
1.4 KiB
Text
77 lines
1.4 KiB
Text
# base requirements
|
|
|
|
# django
|
|
Django==5.2.15
|
|
# rest framework
|
|
djangorestframework==3.17.1
|
|
# postgres
|
|
psycopg==3.3.4
|
|
psycopg-binary==3.3.4
|
|
psycopg-c==3.3.4
|
|
dj-database-url==3.0.1
|
|
# redis
|
|
redis==5.0.4
|
|
django-redis==7.0.0
|
|
# cors
|
|
django-cors-headers==4.9.0
|
|
# celery
|
|
celery==5.5.3
|
|
django_celery_beat==2.9.0
|
|
django-celery-results==2.6.0
|
|
# file serve
|
|
whitenoise==6.12.0
|
|
# fake data
|
|
faker==25.0.0
|
|
# filters
|
|
django-filter==25.2
|
|
# json model
|
|
jsonmodels==2.7.0
|
|
# storage
|
|
django-storages==1.14.6
|
|
# user management
|
|
django-crum==0.7.9
|
|
# web server
|
|
uvicorn==0.29.0
|
|
# sockets
|
|
channels==4.3.2
|
|
# ai
|
|
openai==1.63.2
|
|
# slack
|
|
slack-sdk==3.27.1
|
|
# apm
|
|
scout-apm==3.5.3
|
|
# xlsx generation
|
|
openpyxl==3.1.2
|
|
# logging
|
|
python-json-logger==4.0.0
|
|
# html parser
|
|
beautifulsoup4==4.12.3
|
|
# analytics
|
|
posthog==3.5.0
|
|
# crypto
|
|
cryptography==50.0.0
|
|
# html validator
|
|
lxml==6.1.0
|
|
# s3
|
|
boto3==1.34.96
|
|
# http client (pinned to address CVE-2026-44431 and CVE-2026-44432)
|
|
urllib3>=2.7.0
|
|
# requests — used directly for webhook delivery & link unfurling; pinned to
|
|
# >=2.32 for the get_connection_with_tls_context adapter hook (SSRF IP pinning)
|
|
requests==2.33.0
|
|
# password validator
|
|
zxcvbn==4.4.28
|
|
# timezone
|
|
pytz==2024.1
|
|
# jwt
|
|
PyJWT==2.13.0
|
|
# OpenTelemetry
|
|
opentelemetry-api==1.28.1
|
|
opentelemetry-sdk==1.28.1
|
|
opentelemetry-instrumentation-django==0.49b1
|
|
opentelemetry-exporter-otlp==1.28.1
|
|
opentelemetry-exporter-otlp-proto-grpc==1.28.1
|
|
# OpenAPI Specification
|
|
drf-spectacular==0.29.0
|
|
# html sanitizer
|
|
nh3==0.2.18
|