gavindiaz/NexQuant
1
0
Fork 0
mirror of https://github.com/NicolasBohn/NexQuant.git synced 2026-07-27 23:47:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore: Update Werkzeug to fix CVE-2025-66221

Browse Source 
- Update Werkzeug from ==2.3.8 to >=3.1.6
- Update Flask from ==2.2.5 to >=3.0.0
- Fixes GHSA-hgf8-39gv-g3f2 (Windows device names in safe_join)
- Also fixes CVE-2024-34069 and CVE-2024-49767
This commit is contained in:
TPTBusiness
2026-04-02 22:55:56 +02:00
parent 638ad9aa0c
commit 6ce5ae77cf
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rdagent/scenarios/rl/autorl_bench/benchmarks/webshop/requirements.txt
+6 -6
View File
@@ -24,10 +24,10 @@ rank_bm25==0.2.2
thefuzz==0.19.0
spacy==3.7.2
# Note: Flask/Werkzeug pinned to 2.x (Flask 3.x incompatible with WebShop)
# Note: Flask/Werkzeug updated to 3.x for security fixes
# Security Notes:
# - CVE-2024-34069: Werkzeug debugger RCE (dev mode only)
# - CVE-2024-49767: Resource exhaustion via multipart/form-data
# Mitigation: Benchmark runs locally with max_content_length limits; never use debug=True in production
flask==2.2.5
Werkzeug==2.3.8 # Latest 2.x with security patches (CVE-2024-34069, CVE-2024-49767 mitigated)
# - CVE-2025-66221: Windows device names in safe_join() (fixed in 3.1.4)
# - CVE-2024-34069: Werkzeug debugger RCE (fixed)
# - CVE-2024-49767: Resource exhaustion via multipart/form-data (fixed)
flask>=3.0.0
Werkzeug>=3.1.6 # Security fix: CVE-2025-66221 (Windows device names)