url/homelable
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: upgrade fastapi to 0.135.1, fix starlette CVEs, update auth test assertions

Browse Source 
- fastapi 0.115.0 → 0.135.1 pulls starlette 0.52.1 (fixes CVE-2024-47874, CVE-2025-54121)
- pip-audit: ignore CVE-2024-23342 (ecdsa Minerva attack, no fix exists; app uses HS256 only)
- Update auth guard tests: FastAPI 0.135 returns 401 (not 403) when Bearer token is missing
This commit is contained in:
Pouzor
2026-03-07 15:18:28 +01:00
parent e5262b4b71
commit 1811afa749
7 changed files with 10 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/security.yml
+3 -1
View File
@@ -33,4 +33,6 @@ jobs:
with:
python-version: '3.11'
- name: Pip audit
run: pip install pip-audit && pip-audit -r backend/requirements.txt
# CVE-2024-23342 (ecdsa): timing attack on ECDSA — not exploitable (app uses HS256/HMAC only).
# python-jose forces ecdsa as a dependency with no fixed version available.
run: pip install pip-audit && pip-audit -r backend/requirements.txt --ignore-vuln CVE-2024-23342