| 1 | # ───────────────────────────────────────────────────────────────────────────── |
| 2 | # Accepted residual CVE risks (cannot be remediated upstream from here) |
| 3 | # |
| 4 | # urllib3 1.26.x — pip-audit flags CVE-2025-50181, -66418, -66471, -21441, |
| 5 | # all fixed only in urllib3 2.x. We're stuck on 1.x because |
| 6 | # `elasticsearch7==7.10.1` (which is locked at 7.x for |
| 7 | # Wazuh-indexer compatibility) hard-requires `urllib3<2`. |
| 8 | # Lifting this requires migrating off elasticsearch7. |
| 9 | # |
| 10 | # sqlitedict 2.1.0 — pip-audit flags CVE-2024-35515. Upstream has no fix yet |
| 11 | # (last release Apr 2024). Pulled in transitively by |
| 12 | # ScoutSuite. Either accept or eventually replace ScoutSuite. |
| 13 | # ───────────────────────────────────────────────────────────────────────────── |
| 14 | |
| 15 | aiofiles |
| 16 | aiohttp |
| 17 | aiomysql |
| 18 | aiosqlite |
| 19 | alembic |
| 20 | apscheduler |
| 21 | asyncgelf |
| 22 | azure-identity>=1.16.1 # security floor — CVE-2024-35255 (transitive of ScoutSuite) |
| 23 | bcrypt |
| 24 | cortex4py |
| 25 | cryptography |
| 26 | docxtpl |
| 27 | elasticsearch7==7.10.1 |
| 28 | environs |
| 29 | fastapi |
| 30 | grafana-client |
| 31 | grpcio |
| 32 | grpcio-tools |
| 33 | httpx[http2]<0.29 |
| 34 | influxdb-client[async] |
| 35 | Jinja2 |
| 36 | loguru |
| 37 | miniopy-async |
| 38 | packaging |
| 39 | pdfkit |
| 40 | Pillow # transitive runtime dep of qrcode for 2FA QR generation (qrcode.make() uses qrcode.image.pil) |
| 41 | playwright |
| 42 | pydantic[email] |
| 43 | PyJWT |
| 44 | PyMySQL |
| 45 | pyOpenSSL>=26.0.0 # security floor — CVE-2026-27448, -27459 (transitive of ScoutSuite) |
| 46 | pyotp |
| 47 | python-dotenv |
| 48 | python-magic |
| 49 | python-multipart<1 |
| 50 | pyvelociraptor~=0.1 |
| 51 | PyYAML |
| 52 | qrcode |
| 53 | regex |
| 54 | requests |
| 55 | ScoutSuite |
| 56 | setuptools>=78.1.1 # security floor — Snyk-flagged transitive CVE |
| 57 | SQLAlchemy |
| 58 | sqlmodel |
| 59 | starlette |
| 60 | uvicorn[standard] |
| 61 | werkzeug |
| 62 | xmltodict |
| 63 | zipp>=3.19.1 # security floor — Snyk-flagged transitive CVE |