embeddevio
cc3621a12b
ci / lint (push) Successful in 51s
ci / lint (pull_request) Successful in 44s
contract-openapi / openapi-contract (push) Successful in 49s
contract-openapi / ts-client-is-current (push) Successful in 43s
contract-openapi / openapi-contract (pull_request) Successful in 58s
contract-openapi / ts-client-is-current (pull_request) Successful in 49s
ci / unit (push) Successful in 51s
ci / security (push) Successful in 1m11s
ci / unit (pull_request) Successful in 56s
ci / security (pull_request) Successful in 2m42s
ci / build (push) Successful in 5m35s
ci / build (pull_request) Failing after 42s
ci / image-scan (push) Failing after 45s
ci / image-scan (pull_request) Has been skipped
ci / push (push) Has been skipped
ci / push (pull_request) Has been skipped
После бампа Go/alpine/x-crypto/x-net в образе остались 5 HIGH — все в venv: urllib3 2.7.0 → 2.8.0, msgpack 1.1.2 → 1.2.3, setuptools 70.3.0 → 78.1.1 Refs #61
21 lines
835 B
Plaintext
21 lines
835 B
Plaintext
# Runtime (контроль-плоскость)
|
|
fastapi>=0.115
|
|
uvicorn[standard]>=0.32
|
|
pydantic>=2.9
|
|
pydantic-settings>=2.5
|
|
aiosqlite>=0.20
|
|
httpx>=0.27
|
|
structlog>=24.4
|
|
prometheus-client>=0.21
|
|
|
|
# Транзитивные зависимости с открытыми HIGH — пиним снизу под гейт image-scan (issue #61):
|
|
# urllib3 2.7.0 → CVE-2026-97687 (MITM через HTTPS-прокси) / CVE-2026-97689 (DoS), fix 2.8.0
|
|
# msgpack 1.1.2 → CVE-2026-114613 / GHSA-6v7p-g79w-8964, fix 1.2.3
|
|
# setuptools 70.3.0 → CVE-2025-47273 (path traversal), fix 78.1.1
|
|
urllib3>=2.8.0
|
|
msgpack>=1.2.3
|
|
setuptools>=78.1.1
|
|
|
|
# Сетевой слой вызывается через бинари (awg, iptables, ipset, dnsmasq),
|
|
# поэтому python-зависимостей для сети не требуется.
|