Skip to content

security: Bump authlib and python-multipart for Dependabot alerts #220

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
williajm merged 3 commits into from
Apr 22, 2026
Merged

security: Bump authlib and python-multipart for Dependabot alerts #220

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
419dff4
security: Bump authlib 1.6.9 → 1.7.0, python-multipart 0.0.22 → 0.0.26
williajm Apr 22, 2026
a7a2ae6
fix: Remove exclude-newer block from lock so CI --locked sync works
williajm Apr 22, 2026
d602397
security: Bump fuzzer deps for Dependabot alerts on .clusterfuzzlite
williajm Apr 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions .clusterfuzzlite/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,12 +23,12 @@ pydantic-settings==2.6.1 \
loguru==0.7.3 \
--hash=sha256:31a33c10c8e1e10422bfd431aeb5d351c7cf7fa671e3c4df004162264b28220c

cryptography==46.0.6 \
--hash=sha256:9a693028b9cbe51b5a1136232ee8f2bc242e4e19d456ded3fa7c86e43c713b4a
cryptography==46.0.7 \
--hash=sha256:5ad9ef796328c5e3c4ceed237a183f5d41d21150f972455a9d926593a1dcb308

# OAuth/OIDC authentication dependencies (added in v1.1.0)
authlib==1.6.9 \
--hash=sha256:f08b4c14e08f0861dc18a32357b33fbcfd2ea86cfe3fe149484b4d764c4a0ac3
authlib==1.6.11 \
--hash=sha256:c8687a9a26451c51a34a06fa17bb97cb15bba46a6a626755e2d7f50da8bff3e3

httpx==0.28.1 \
--hash=sha256:d909fcccc110f8c7faf814ca82a9a4d816bc5a6dbfea25d6591d6985b8ba59ad
Expand Down Expand Up @@ -56,8 +56,8 @@ annotated-types==0.7.0 \
typing-extensions==4.15.0 \
--hash=sha256:f0fa19c6845758ab08074a0cfa8b7aecb71c999ca73d62883bc25cc018c4e548

python-dotenv==1.2.1 \
--hash=sha256:b81ee9561e9ca4004139c6cbba3a238c32b03e4894671e181b671e8cb8425d61
python-dotenv==1.2.2 \
--hash=sha256:1d8214789a24de455a8b8bd8ae6fe3c6b69a5e3d64aa8a8e5d68e694bbcb285a

cffi==2.0.0 \
--hash=sha256:8941aaadaf67246224cee8c3803777eed332a19d909b47e29c9842ef1e79ac26
Expand Down
4 changes: 2 additions & 2 deletions pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,10 +46,10 @@ dependencies = [
"limits>=5.8.0",
"cachetools>=7.0.5",
"secure>=1.0.1",
"authlib>=1.6.9",
"authlib>=1.6.11", # GHSA-jj8c-mmj3-mmgv
"httpx>=0.28.1",
"typer>=0.24.1",
"python-multipart>=0.0.22", # CVE-2026-24486: Path traversal fix
"python-multipart>=0.0.26", # CVE-2026-24486 / CVE-2026-40347: Path traversal fix
]

[project.optional-dependencies]
Expand Down
29 changes: 21 additions & 8 deletions uv.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading