nova/DungeonsDragons
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix backend dependency vulnerabilities (36 CVEs across 6 packages)

Browse Source 
Upgrades fastapi (0.115.6->0.141.1, pulling starlette to 1.6.0),
fastapi-users (14.0.1->15.0.5), aiosmtplib (3.0.2->5.1.2),
python-multipart (0.0.20->0.0.32), and sentence-transformers
(3.3.1->6.0.1, pulling transformers and pyjwt to patched versions).

Verified via pip-audit (zero remaining findings across all 97
resolved dependencies) and functional smoke tests: auth flow, RAG
embedding/retrieval (dimension still 384, similarity still sane),
DM-turn tool-calling (roll_dice still fires correctly), and a live
WebSocket handshake/send/broadcast round trip against the upgraded
Starlette.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Thorsten
2026-09-06 21:26:10 +02:00
parent cc680dc392
commit d62970ee1b
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/requirements.txt
+5 -5
View File
@@ -1,13 +1,13 @@
fastapi==0.115.6 fastapi==0.141.1
uvicorn[standard]==0.34.0 uvicorn[standard]==0.34.0
sqlalchemy[asyncio]==2.0.36 sqlalchemy[asyncio]==2.0.36
asyncpg==0.30.0 asyncpg==0.30.0
alembic==1.14.0 alembic==1.14.0
pydantic-settings==2.7.0 pydantic-settings==2.7.0
fastapi-users[sqlalchemy]==14.0.1 fastapi-users[sqlalchemy]==15.0.5
openai>=1.50.0,<2.0.0 openai>=1.50.0,<2.0.0
aiosmtplib==3.0.2 aiosmtplib==5.1.2
python-multipart==0.0.20 python-multipart==0.0.32
websockets==14.1 websockets==14.1
pgvector==0.3.6 pgvector==0.3.6
sentence-transformers==3.3.1 sentence-transformers==6.0.1