twothatITandClaude Sonnet 5
565dc5f710
Dependabot alert #25 (python-jose algorithm confusion guard bypassed by DER-encoded public keys, CVE-2026-85394, Critical) has no patched version of python-jose available at all - it's affected through the latest release 3.5.0. python-jose was only used in app/dependencies.py for plain HS256 JWT encode/decode with our own symmetric SECRET_KEY (algorithms=[...] was already explicitly restricted on every decode call, so the specific RS256/HS256 confusion path didn't apply here), but staying on an unmaintained library that keeps generating unfixable critical alerts isn't sustainable. Swapped to PyJWT, which is actively maintained, already pulled in transitively via msal, and a near drop-in replacement for this app's encode()/decode() usage. Verified with a Docker build and in-container token create/verify/reject round-trip. Co-Authored-By: Claude Sonnet 5 <[email protected]>
29 lines
505 B
Plaintext
29 lines
505 B
Plaintext
# NetBird MSP Appliance - Python Dependencies
|
|
fastapi==0.104.1
|
|
uvicorn[standard]==0.24.0
|
|
sqlalchemy==2.0.23
|
|
aiosqlite==0.19.0
|
|
pydantic==2.5.2
|
|
pydantic-settings==2.1.0
|
|
PyJWT==2.15.1
|
|
passlib[bcrypt]==1.7.4
|
|
bcrypt==4.1.2
|
|
cryptography==50.0.0
|
|
python-multipart==0.0.31
|
|
httpx==0.28.1
|
|
jinja2==3.1.6
|
|
docker==7.0.0
|
|
requests<2.32.0
|
|
urllib3<2
|
|
psutil==5.9.7
|
|
pyyaml==6.0.1
|
|
msal==1.39.0
|
|
pyotp==2.9.0
|
|
qrcode[pil]==7.4.2
|
|
slowapi==0.1.9
|
|
pywinrm>=0.4.3
|
|
ldap3>=2.9.1
|
|
pytest==9.0.3
|
|
pytest-asyncio==1.4.0
|
|
pytest-httpx==0.36.2
|