fix(deps): add security floor pins for 6 transitive dependencies
Tristan committed
Mar 9, 2026 at 17:15 UTC
dfe691d505930e22ff4ac57da55ae78cd42483fa
1 file changed
+8
requirements.txt
+8
@@ -51,3 +51,11 @@ pywinpty==3.0.2; sys_platform == "win32"
51
python-socketio>=5.14.2
52
uvicorn>=0.38.0
53
wsproto>=1.2.0
54
+# Security floor pins for transitive dependencies
55
+# These packages are pulled transitively — floor pins prevent resolver regressions
56
+Pillow>=10.2.0 # security floor: heap buffer overflow CWE-122, eval injection CWE-95, DoS CWE-400
57
+nltk>=3.9.3 # security floor: RCE CWE-94, code injection CWE-94
58
+h11>=0.16.0 # security floor: HTTP request smuggling CWE-444
59
+urllib3>=2.6.0 # security floor: resource exhaustion CWE-770, data amplification CWE-409
60
+cryptography>=46.0.0 # security floor: insufficient data authenticity CWE-345
61
+werkzeug>=3.0.3 # security floor: RCE CWE-94