zlei6/ragflow
1
0
Fork 0
mirror of https://github.com/infiniflow/ragflow.git synced 2026-08-12 20:03:40 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: remediate urllib3 CVEs (#16907)

Browse Source
This commit is contained in:
rayhan
2026-07-14 15:57:29 +01:00
committed by GitHub
parent b506d8ec5f
commit 75d9efa27c
8 changed files with 52 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
pyproject.toml
View File

@@ -210,6 +210,15 @@ constraint-dependencies = [
# encounters (fixed in trio 0.26 by skipping non-callables). Pulled in transitively
# via selenium-wire -> trio-websocket -> trio.
"trio>=0.26.0",
# CVE-2026-44431: Cross-origin redirects in urllib3's low-level API may forward sensitive credential
# headers to unintended hosts. (CVSS 5.3)
# CVE-2026-44432: Decompression flaw in urllib3's streaming API can lead to client-side denial of service
# through excessive resource consumption. (CVSS 8.9)
# urllib3 < 2.7.0 is vulnerable, pulled in transitively via requests, minio, akshare, and others
"urllib3>=2.7.0",
]
exclude-dependencies = [
# crawl4ai>=0.8.6 depends on unclecode-litellm, which installs the same