Skip to content

[Snyk] Fix for 3 vulnerabilities #94

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
arthrod wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Snyk] Fix for 3 vulnerabilities #94

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions backend/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,3 +104,5 @@ googleapis-common-protos==1.63.2

## LDAP
ldap3==2.9.1
fonttools>=4.61.0 # not directly required, pinned by Snyk to avoid a vulnerability
urllib3>=2.6.0 # not directly required, pinned by Snyk to avoid a vulnerability
Comment on lines +107 to +108

@gemini-code-assist gemini-code-assist Bot Dec 13, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

The versions suggested for fonttools and urllib3 appear to be incorrect and will likely cause the build to fail as they don't seem to exist on PyPI.

  • For fonttools, version >=4.61.0 is suggested, but the latest version on PyPI appears to be 4.53.1.
  • For urllib3, version >=2.6.0 is suggested, but the latest version on PyPI is 2.2.2. The vulnerabilities mentioned (SNYK-PYTHON-URLLIB3-14192442, SNYK-PYTHON-URLLIB3-14192443) are fixed in versions >=1.26.18 for the 1.x series and >=2.2.1 for the 2.x series.

Please investigate and pin to the correct, existing versions that resolve the vulnerabilities. For urllib3, urllib3>=2.2.2 would be a safe choice.

For better build reproducibility in your Docker environment, which installs from this file directly, consider pinning to an exact version with == once the correct versions are identified, for example urllib3==2.2.2.

Comment on lines +107 to +108

@gemini-code-assist gemini-code-assist Bot Dec 13, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

This project uses pyproject.toml to declare dependencies, but this change only modifies requirements.txt. This creates an inconsistency between the development environment (managed by rye, using pyproject.toml and uv.lock) and the Docker environment (using requirements.txt).

To ensure consistency and simplify dependency management, I recommend the following:

  1. Add these pinned dependencies to pyproject.toml.
  2. Regenerate requirements.txt and uv.lock from pyproject.toml as the single source of truth.

This will prevent potential bugs caused by different dependency versions in different environments.

Loading