gsadmin/flowfish
1
0
Fork 0
mirror of https://github.com/taylanbakircioglu/flowfish.git synced 2026-09-12 05:48:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): patch CRITICAL Dependabot findings (python-jose 3.4.0, jspdf 4.2.1)

Browse Source 
- python-jose[cryptography] 3.3.0 -> 3.4.0 (CVE-2024-33663 algorithm
  confusion) in backend + api-gateway. App uses HS256 only; encode/decode
  API unchanged; 3.3.0<->3.4.0 tokens cross-verifiable (rolling-deploy safe).
- jspdf 4.0.0 -> 4.2.1 (CVE-2026-31938 HTML injection in new-window paths)
  in frontend; @babel/runtime bumped 7.28.4 -> 7.28.6 (required by jspdf
  4.2.1). App uses only new jsPDF()/autoTable()/doc.save() — vulnerable
  output path not used.

Verified: jose roundtrip + cross-version, frontend npm build, backend &
frontend docker images, and Kubernetes (kind) jose 3.4.0 + frontend serve.
No feature/UI behavior change; backward compatible.
This commit is contained in:
taylanbakircioglu
2026-06-03 01:35:06 +03:00
parent b7e0e9efc5
commit 613ed0bf99
4 changed files with 11 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/requirements.txt
+1 -1
View File
@@ -28,7 +28,7 @@ redis[hiredis]==5.0.1
pika==1.3.2
# Authentication & Security
python-jose[cryptography]==3.3.0
python-jose[cryptography]==3.4.0 # CVE-2024-33663 fix (algorithm confusion)
cryptography>=42.0.4 # CVE-2024-26130, CVE-2023-50782 fix
passlib==1.7.4
bcrypt==4.0.1 # Pin bcrypt version for passlib compatibility
frontend/package-lock.json
Generated
+8 -8
View File
@@ -23,7 +23,7 @@
"cytoscape-dagre": "^2.5.0",
"cytoscape-fcose": "^2.2.0",
"dagre": "^0.8.5",
"jspdf": "^4.0.0",
"jspdf": "^4.2.1",
"jspdf-autotable": "^5.0.7",
"jszip": "^3.10.1",
"react": "^18.2.0",
@@ -2188,9 +2188,9 @@
}
},
"node_modules/@babel/runtime": {
"version": "7.28.4",
"resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.28.4.tgz",
"integrity": "sha512-Q/N6JNWvIvPnLDvjlE1OUBLPQHH6l3CltCEsHIujp45zQUSSh8K+gHnaEX45yAT1nyngnINhvWtzN+Nb9D8RAQ==",
"version": "7.28.6",
"resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.28.6.tgz",
"integrity": "sha512-05WQkdpL9COIMz4LjTxGpPNCdlpyimKppYNoJ5Di5EUObifl8t4tuLuUBBZEpoLYOmfvIWrsp9fCl0HoPRVTdA==",
"license": "MIT",
"engines": {
"node": ">=6.9.0"
@@ -14830,12 +14830,12 @@
}
},
"node_modules/jspdf": {
"version": "4.0.0",
"resolved": "https://registry.npmjs.org/jspdf/-/jspdf-4.0.0.tgz",
"integrity": "sha512-w12U97Z6edKd2tXDn3LzTLg7C7QLJlx0BPfM3ecjK2BckUl9/81vZ+r5gK4/3KQdhAcEZhENUxRhtgYBj75MqQ==",
"version": "4.2.1",
"resolved": "https://registry.npmjs.org/jspdf/-/jspdf-4.2.1.tgz",
"integrity": "sha512-YyAXyvnmjTbR4bHQRLzex3CuINCDlQnBqoSYyjJwTP2x9jDLuKDzy7aKUl0hgx3uhcl7xzg32agn5vlie6HIlQ==",
"license": "MIT",
"dependencies": {
"@babel/runtime": "^7.28.4",
"@babel/runtime": "^7.28.6",
"fast-png": "^6.2.0",
"fflate": "^0.8.1"
},
frontend/package.json
+1 -1
View File
@@ -20,7 +20,7 @@
"cytoscape-dagre": "^2.5.0",
"cytoscape-fcose": "^2.2.0",
"dagre": "^0.8.5",
"jspdf": "^4.0.0",
"jspdf": "^4.2.1",
"jspdf-autotable": "^5.0.7",
"jszip": "^3.10.1",
"react": "^18.2.0",
services/api-gateway/requirements.txt
+1 -1
View File
@@ -12,7 +12,7 @@ grpcio-tools==1.68.1
protobuf>=5.29.2 # Security update
# Authentication & Security
python-jose[cryptography]==3.3.0
python-jose[cryptography]==3.4.0 # CVE-2024-33663 fix (algorithm confusion)
cryptography>=42.0.4 # CVE-2024-26130, CVE-2023-50782 fix
passlib[bcrypt]==1.7.4
python-dotenv==1.0.0