gavindiaz/NexQuant
1
0
Fork 0
mirror of https://github.com/NicolasBohn/NexQuant.git synced 2026-07-27 15:37:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(deps): pin aiohttp>=3.13.4 to patch 4 CVEs

Browse Source 
Explicitly require aiohttp>=3.13.4 to ensure the patched version is
installed regardless of what mlflow, langchain-community, or litellm
resolve as their transitive dependency.

Fixes Dependabot alerts #64, #67, #68, #73:
- CVE-2026-22815: unlimited trailer headers (memory exhaustion)
- CVE-2026-34515: UNC SSRF / NTLMv2 credential theft on Windows
- CVE-2026-34516: multipart header size bypass (DoS)
- CVE-2026-34525: duplicate Host header acceptance

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
TPTBusiness
2026-04-17 22:02:07 +02:00
parent d8ab86d6cf
commit 616590cdc0
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
requirements.txt
+1
View File
@@ -9,6 +9,7 @@ fire
fuzzywuzzy
openai
litellm>=1.73 # to support `from litellm import get_valid_models`
aiohttp>=3.13.4 # CVE-2026-22815, CVE-2026-34515, CVE-2026-34516, CVE-2026-34525
azure.identity
pyarrow
rich