@cryptotaxi247 / CoPilot / commits / 3993ddb2

chore: address 5 CVEs flagged by pip-audit; document 5 residual accepted risks (#856)

pip-audit against the post-#854 requirements.txt found 10 vulnerabilities in 5 packages. Snyk PR #847 also flagged this area but was generated before the recent migration work landed and proposed several stale or infeasible bumps (cryptography already done in #848; urllib3->2.x would break elasticsearch7). This PR cherry-picks only the parts of Snyk's proposal that pip-audit independently confirms, plus one Snyk missed. Eliminated (5 CVEs): - azure-identity 1.5.0 → 1.25.3 CVE-2024-35255 - pyOpenSSL 25.3.0 → 26.2.0 CVE-2026-27448, CVE-2026-27459 - starlette 0.46.2 → 1.0.0 CVE-2025-54121, CVE-2025-62727 (lifted via fastapi cap removal, fastapi 0.115 → 0.136 follows) - setuptools pinned >=78.1.1 Snyk-flagged transitive (already satisfied by base image's 82.0.1 but explicit floor for the future) - zipp pinned >=3.19.1 Snyk-flagged transitive Accepted residual risk (5 CVEs, documented in requirements.in header): - urllib3 1.26.20 CVE-2025-50181, -66418, -66471, CVE-2026-21441 Stuck on 1.x — elasticsearch7==7.10.1 hard-requires urllib3<2; bumping requires migrating off elasticsearch7 (out of scope; the 7.x line is locked for Wazuh-indexer compatibility). - sqlitedict 2.1.0 CVE-2024-35515. Last sqlitedict release was Apr 2024; no upstream fix exists. Pulled transitively by ScoutSuite. Either accept or eventually replace ScoutSuite. Snyk PR #847 will be closed with explanation: cryptography bump already landed in #848, urllib3 bump would break elasticsearch7, the rest of its proposal is captured here. requirements.in changes: + header comment block documenting the two accepted residual risks + azure-identity>=1.16.1 (security floor) + pyOpenSSL>=26.0.0 (security floor) + setuptools>=78.1.1 (security floor; pip-tools filters it from requirements.txt as "unsafe", but the base image's 82.0.1 satisfies the floor) + zipp>=3.19.1 (security floor) - fastapi<0.116 → fastapi (lift cap; pulls newer starlette transitively, which fixes 2 CVEs) Verified locally: - docker build succeeds; backend boots clean - admin login: HTTP 200 - 2FA setup: HTTP 200 - pip-audit on the new requirements.txt: only the 5 documented accepted-risk CVEs remain (down from 10) - all installed versions match their security floors: azure-identity 1.25.3 pyOpenSSL 26.2.0 cryptography 48.0.0 fastapi 0.136.1 starlette 1.0.0 setuptools 82.0.1 (in container) zipp 3.23.1 Co-authored-by: taylor_socfortress <taylor.walton@socfortress.co> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

taylorcopilot committed May 8, 2026 at 10:48 UTC 3993ddb2b33bfc32e8181c3857af6a0cedb7aac4
2 files changed +73 -44
backend/requirements.in
+19 -1
@@ -1,3 +1,17 @@
1 +# ─────────────────────────────────────────────────────────────────────────────
2 +# Accepted residual CVE risks (cannot be remediated upstream from here)
3 +#
4 +# urllib3 1.26.x — pip-audit flags CVE-2025-50181, -66418, -66471, -21441,
5 +# all fixed only in urllib3 2.x. We're stuck on 1.x because
6 +# `elasticsearch7==7.10.1` (which is locked at 7.x for
7 +# Wazuh-indexer compatibility) hard-requires `urllib3<2`.
8 +# Lifting this requires migrating off elasticsearch7.
9 +#
10 +# sqlitedict 2.1.0 — pip-audit flags CVE-2024-35515. Upstream has no fix yet
11 +# (last release Apr 2024). Pulled in transitively by
12 +# ScoutSuite. Either accept or eventually replace ScoutSuite.
13 +# ─────────────────────────────────────────────────────────────────────────────
14 +
15 aiofiles
16 aiohttp
17 aiomysql
@@ -5,13 +19,14 @@ aiosqlite
19 alembic
20 apscheduler
21 asyncgelf
22 +azure-identity>=1.16.1 # security floor — CVE-2024-35255 (transitive of ScoutSuite)
23 bcrypt
24 cortex4py
25 cryptography
26 docxtpl
27 elasticsearch7==7.10.1
28 environs
14 -fastapi<0.116
29 +fastapi
30 grafana-client
31 grpcio
32 grpcio-tools
@@ -25,6 +40,7 @@ pdfkit
40 Pillow # transitive runtime dep of qrcode for 2FA QR generation (qrcode.make() uses qrcode.image.pil)
41 playwright
42 pydantic[email]
43 +pyOpenSSL>=26.0.0 # security floor — CVE-2026-27448, -27459 (transitive of ScoutSuite)
44 PyJWT
45 PyMySQL
46 pyotp
@@ -37,9 +53,11 @@ qrcode
53 regex
54 requests
55 ScoutSuite
56 +setuptools>=78.1.1 # security floor — Snyk-flagged transitive CVE
57 SQLAlchemy
58 sqlmodel
59 starlette
60 uvicorn[standard]
61 werkzeug
62 xmltodict
63 +zipp>=3.19.1 # security floor — Snyk-flagged transitive CVE
backend/requirements.txt
+54 -43
@@ -1,3 +1,4 @@
1 +adal==1.2.7
2 aiocsv==1.4.0
3 aiofiles==25.1.0
4 aiohappyeyeballs==2.6.1
@@ -19,75 +20,78 @@ aliyun-python-sdk-vpc==3.0.48
20 annotated-doc==0.0.4
21 annotated-types==0.7.0
22 anyio==4.13.0
23 +applicationinsights==0.11.10
24 apscheduler==3.11.2
25 +argcomplete==3.5.3
26 argon2-cffi==23.1.0
27 argon2-cffi-bindings==25.1.0
28 asyncgelf==1.2.0
29 asyncio==4.0.0
30 asyncio-throttle==0.1.1
31 attrs==26.1.0
32 +azure-cli-core==2.86.0
33 +azure-cli-telemetry==1.1.0
34 azure-common==1.1.28
30 -azure-core==1.41.0
31 -azure-identity==1.5.0
32 -azure-mgmt-authorization==3.0.0
33 -azure-mgmt-compute==18.2.0
35 +azure-core==1.39.0
36 +azure-graphrbac==0.61.2
37 +azure-identity==1.25.3
38 +azure-mgmt-authorization==4.0.0
39 +azure-mgmt-compute==38.0.0
40 azure-mgmt-core==1.6.0
35 -azure-mgmt-keyvault==8.0.0
36 -azure-mgmt-monitor==2.0.0
37 -azure-mgmt-network==17.1.0
38 -azure-mgmt-rdbms==8.0.0
39 -azure-mgmt-redis==12.0.0
40 -azure-mgmt-resource==15.0.0
41 -azure-mgmt-security==1.0.0
42 -azure-mgmt-sql==1.0.0
43 -azure-mgmt-storage==17.0.0
44 -azure-mgmt-web==1.0.0
41 +azure-mgmt-keyvault==14.0.1
42 +azure-mgmt-monitor==7.0.0
43 +azure-mgmt-network==30.2.0
44 +azure-mgmt-redis==14.5.0
45 +azure-mgmt-security==7.0.0
46 +azure-mgmt-sql==3.0.1
47 +azure-mgmt-storage==24.0.1
48 +azure-mgmt-web==11.0.0
49 backports-tarfile==1.2.0
50 bcrypt==5.0.0
51 boto3==1.43.6
52 botocore==1.43.6
49 -cachetools==4.2.4
53 certifi==2025.11.12
54 cffi==2.0.0
55 charset-normalizer==3.4.7
56 cheroot==11.1.2
57 cherrypy==18.10.0
58 cherrypy-cors==1.7.0
56 -circuitbreaker==2.1.3
59 click==8.3.3
60 coloredlogs==10.0
61 +configparser==7.2.0
62 cortex4py==2.1.0
63 crcmod==1.7
61 -cryptography==46.0.7
64 +cryptography==48.0.0
65 +distro==1.9.0
66 dnspython==2.8.0
67 docxtpl==0.20.2
64 -durationpy==0.10
68 elasticsearch7==7.10.1
69 email-validator==2.3.0
70 environs==15.0.1
68 -fastapi==0.115.14
71 +fastapi==0.136.1
72 frozenlist==1.8.0
70 -google-api-core[grpc]==1.31.5
73 +google-api-core[grpc]==2.30.3
74 google-api-python-client==2.196.0
72 -google-auth==1.35.0
75 +google-auth==2.52.0
76 google-auth-httplib2==0.4.0
74 -google-cloud-appengine-logging==1.1.1
77 +google-cloud-appengine-logging==1.9.0
78 google-cloud-audit-log==0.5.0
76 -google-cloud-container==2.10.7
77 -google-cloud-core==2.3.1
78 -google-cloud-iam==2.6.1
79 -google-cloud-kms==1.3.0
80 -google-cloud-logging==3.1.1
81 -google-cloud-monitoring==1.1.0
82 -google-cloud-resource-manager==1.5.0
83 -google-cloud-storage==2.11.0
79 +google-cloud-container==2.64.0
80 +google-cloud-core==2.6.0
81 +google-cloud-iam==2.23.0
82 +google-cloud-kms==3.13.0
83 +google-cloud-logging==3.15.0
84 +google-cloud-monitoring==2.30.0
85 +google-cloud-resource-manager==1.17.0
86 +google-cloud-storage==3.10.1
87 google-crc32c==1.8.0
88 google-resumable-media==2.9.0
89 googleapis-common-protos[grpc]==1.75.0
90 grafana-client==5.1.0
91 greenlet==3.5.0
89 -grpc-google-iam-v1==0.12.4
92 +grpc-google-iam-v1==0.14.4
93 grpcio==1.80.0
94 +grpcio-status==1.80.0
95 grpcio-tools==1.80.0
96 h11==0.16.0
97 h2==4.3.0
@@ -101,6 +105,7 @@ httpx[http2]==0.28.1
105 humanfriendly==10.0
106 hyperframe==6.1.0
107 idna==3.13
108 +importlib-metadata==8.7.1
109 influxdb-client[async]==1.50.0
110 isodate==0.7.2
111 jaraco-collections==5.2.1
@@ -110,7 +115,7 @@ jaraco-text==4.2.0
115 jh2==5.0.11
116 jinja2==3.1.6
117 jmespath==0.10.0
113 -kubernetes==35.0.0
118 +knack==0.11.0
119 loguru==0.7.3
120 lxml==6.1.0
121 mako==1.3.12
@@ -118,22 +123,25 @@ markdown-it-py==4.2.0
123 markupsafe==3.0.3
124 marshmallow==4.3.0
125 mdurl==0.1.2
126 +microsoft-security-utilities-secret-masker==1.0.0b4
127 miniopy-async==1.23.5
128 more-itertools==11.0.2
123 -msal==1.36.0
124 -msal-extensions==0.3.1
125 -msgraph-core==0.2.2
129 +msal==1.35.1
130 +msal-extensions==1.3.1
131 msrest==0.7.1
132 +msrestazure==0.6.4.post1
133 multidict==6.7.1
134 netaddr==1.3.0
135 niquests==3.18.7
136 oauth2client==4.1.3
137 oauthlib==3.3.1
132 -oci==2.168.1
138 +oci==2.9.0
139 +opentelemetry-api==1.41.1
140 oss2==2.19.1
141 packaging==26.2
142 pdfkit==1.0.0
143 pillow==12.2.0
144 +pkginfo==1.12.1.2
145 playwright==1.59.0
146 policyuniverse==1.5.1.20231109
147 portalocker==2.10.1
@@ -141,20 +149,22 @@ portend==3.2.1
149 propcache==0.4.1
150 proto-plus==1.28.0
151 protobuf==6.33.6
152 +psutil==7.2.2
153 +py-deviceid==0.1.1
154 pyasn1==0.6.3
155 pyasn1-modules==0.4.2
156 pycparser==3.0
157 pycryptodome==3.23.0
148 -pydantic-core==2.46.4
158 pydantic[email]==2.13.4
150 -pydo==0.34.0
159 +pydantic-core==2.46.4
160 pyee==13.0.1
161 pygments==2.20.0
162 pyjwt[crypto]==2.12.1
163 pymysql==1.1.3
155 -pyopenssl==25.3.0
164 +pyopenssl==26.2.0
165 pyotp==2.9.0
166 pyparsing==3.3.2
167 +pysocks==1.7.1
168 python-dateutil==2.8.0
169 python-docx==1.2.0
170 python-dotenv==1.2.2
@@ -167,18 +177,19 @@ qh3==1.8.1
177 qrcode==8.2
178 reactivex==4.1.0
179 regex==2026.4.4
170 -requests==2.33.1
180 +requests[socks]==2.33.1
181 requests-oauthlib==2.0.0
182 rich==15.0.0
183 rsa==4.9.1
184 s3transfer==0.17.0
175 -scoutsuite==5.14.0
185 +scoutsuite==5.9.1
186 shellingham==1.5.4
187 six==1.17.0
188 sqlalchemy==2.0.49
189 sqlitedict==2.1.0
190 sqlmodel==0.0.38
181 -starlette==0.46.2
191 +starlette==1.0.0
192 +tabulate==0.10.0
193 tempora==5.9.0
194 typer==0.25.1
195 typer-slim==0.24.0
@@ -194,12 +205,12 @@ uvloop==0.22.1
205 verlib2==0.3.2
206 wassima==2.0.6
207 watchfiles==1.1.1
197 -websocket-client==1.9.0
208 websockets==16.0
209 werkzeug==3.1.8
210 xmltodict==1.0.4
211 yarl==1.23.0
212 zc-lockfile==4.0
213 +zipp==3.23.1
214
215 # The following packages are considered to be unsafe in a requirements file:
216 # setuptools