chore(deps): bump cryptography and undici to patched versions - #70
Merged
Conversation
Bump the transitive cryptography dependency (pulled in via pyjwt's crypto extra, itself required by mcp) from 49.0.0 to 50.0.0, fixing GHSA-g6cj-pr64-35w5, a Bleichenbacher oracle in PKCS7 EnvelopedData decryption. Pin undici to >=7.29.0 via an npm override, since it only reaches the web dashboard as a transitive dependency of jsdom (a dev dependency). This clears five undici advisories covering CRLF injection, cache directive parsing, cookie attribute injection, response desynchronization, and a cache directive crash. No application code changed; both the pytest suite and the web vitest suite pass unmodified.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This addresses six open Dependabot alerts.
cryptography was locked at 49.0.0, vulnerable to GHSA-g6cj-pr64-35w5 (a Bleichenbacher oracle in PKCS7 EnvelopedData decryption through distinguishable errors and timing). It reaches this project transitively through pyjwt's crypto extra, which mcp depends on. Bumped to 50.0.0 via uv lock --upgrade-package cryptography.
undici was locked at 7.28.0 in web/package-lock.json, vulnerable to five advisories (GHSA-m8rv-5g2x-5cg5, GHSA-jr45-8vmc-qm54, GHSA-v3r7-h72x-cjcm, GHSA-8xcm-r25x-g524, GHSA-4cwx-7wf7-3272), covering CRLF injection, cache directive parsing, cookie attribute injection, response desync, and a crash on malformed cache directives. It only reaches the dashboard as a dev-only transitive dependency of jsdom, so rather than adding it as a direct dependency I pinned it through an npm override in web/package.json to >=7.29.0.
Nothing in the application code touches either package directly, so no call sites needed changes. Verified with uv run pytest (672 passed) and npm run test in web/ (140 passed), plus npm run build to confirm the dashboard still builds.