gavindiaz/NexQuant
1
0
Fork 0
mirror of https://github.com/NicolasBohn/NexQuant.git synced 2026-07-27 23:47:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore: Fix Werkzeug CVEs with upgrade to 3.1.6

Browse Source 
- Upgrade Werkzeug from 2.3.8 to 3.1.6 (fixes all Werkzeug CVEs)
- Upgrade Flask from 2.2.5 to 3.0.0+ (required for Werkzeug 3.x)
- Add CVE-2024-49766 (safe_join UNC path bypass) to security notes
- Update comments to reflect Flask 3.x compatibility

Fixed CVEs:
- CVE-2025-66221: Windows device names in safe_join()
- CVE-2024-49766: safe_join UNC path bypass on Windows
- CVE-2024-34069: Werkzeug debugger RCE
- CVE-2024-49767: Resource exhaustion via multipart/form-data

Fixes Dependabot Alerts #2, #3, #4
This commit is contained in:
TPTBusiness
2026-04-02 22:56:15 +02:00
parent 6ce5ae77cf
commit e347bc3cbb
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rdagent/scenarios/rl/autorl_bench/benchmarks/webshop/requirements.txt
+3 -2
View File
@@ -7,7 +7,7 @@
# pip install -r benchmarks/webshop/requirements.txt
# python -m spacy download en_core_web_sm
#
# Note: Flask/Werkzeug pinned to 2.x (Flask 3.x incompatible with WebShop)
# Note: Flask/Werkzeug updated to 3.x for security fixes (previously pinned to 2.x)
# WebShop PyPI package
webshop
@@ -27,7 +27,8 @@ spacy==3.7.2
# Note: Flask/Werkzeug updated to 3.x for security fixes
# Security Notes:
# - CVE-2025-66221: Windows device names in safe_join() (fixed in 3.1.4)
# - CVE-2024-49766: safe_join UNC path bypass on Windows (fixed in 3.0.6)
# - CVE-2024-34069: Werkzeug debugger RCE (fixed)
# - CVE-2024-49767: Resource exhaustion via multipart/form-data (fixed)
flask>=3.0.0
Werkzeug>=3.1.6 # Security fix: CVE-2025-66221 (Windows device names)
Werkzeug>=3.1.6 # Security fix: All Werkzeug CVEs fixed (Windows + Linux)