laantungir/routstr-core
1
0
Fork 0
mirror of https://github.com/Routstr/routstr-core.git synced 2026-10-05 12:28:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

clean up

Browse Source
This commit is contained in:
9qeklajc
2026-09-09 22:19:04 +02:00
parent e7666bd75b
commit 5918cdf839
2 changed files with 19 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pyproject.toml
+12 -15
View File
@@ -88,24 +88,21 @@ disallow_untyped_decorators = true
[tool.uv.sources]
routstr = { workspace = true }
# Security overrides (2026-09): cashu 0.20.x pins conservative upper bounds
# (h11<0.15, fastapi<0.116, cryptography<44, setuptools<76, wheel<0.42) that
# conflict with the patched versions of these libraries. routstr only imports
# cashu's wallet-side modules, which never exercise the fastapi/starlette/h11
# server paths those caps were set for.
# Security floors. cashu 0.20.x caps h11, fastapi, cryptography, setuptools
# and wheel below their patched versions. routstr uses only cashu's wallet
# modules, not its server paths, so the caps are safe to lift here.
[tool.uv]
override-dependencies = [
"h11>=0.16.0", # CVE-2025-43859: chunked-encoding smuggling (critical)
"fastapi[standard-no-fastapi-cloud-cli]>=0.141", # gateway to the starlette>=1.3.1 line (cashu caps <0.116)
"cryptography>=49.0.0", # GHSA-jwv3-5hgf-82ww et al. (cashu caps <44)
"setuptools>=83.0.0", # CVE-2026-59890, CVE-2025-47273 (cashu caps <76)
"wheel>=0.46.2", # CVE-2026-24049 (cashu caps <0.42)
"h11>=0.16.0",
"fastapi[standard-no-fastapi-cloud-cli]>=0.141",
"cryptography>=49.0.0",
"setuptools>=83.0.0",
"wheel>=0.46.2",
]
# Floors for transitive deps whose locked versions are still in-range for their
# dependents but below the patched versions. Constraints (unlike overrides)
# don't bypass any upstream pin — they only force the resolver to take the
# fixed versions.
# Transitive deps whose dependents allow the patched version but don't require
# it. Constraints raise the floor without bypassing any upstream pin.
constraint-dependencies = [
"starlette>=1.3.1", # CVE-2026-54283, CVE-2026-48818, CVE-2026-48817, CVE-2026-48710, CVE-2025-62727, CVE-2025-54121
"starlette>=1.3.1",
"httpcore>=1.0.9", # 1.0.8 caps h11<0.15
]
uv.lock
Generated
+7 -4
View File
@@ -8,7 +8,10 @@ resolution-markers = [
]
[manifest]
constraints = [{ name = "starlette", specifier = ">=1.3.1" }]
constraints = [
{ name = "httpcore", specifier = ">=1.0.9" },
{ name = "starlette", specifier = ">=1.3.1" },
]
overrides = [
{ name = "cryptography", specifier = ">=49.0.0" },
{ name = "fastapi", extras = ["standard-no-fastapi-cloud-cli"], specifier = ">=0.141" },
@@ -1296,15 +1299,15 @@ wheels = [
[[package]]
name = "httpcore"
version = "1.0.8"
version = "1.0.9"
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "certifi" },
{ name = "h11" },
]
sdist = { url = "https://files.pythonhosted.org/packages/9f/45/ad3e1b4d448f22c0cff4f5692f5ed0666658578e358b8d58a19846048059/httpcore-1.0.8.tar.gz", hash = "sha256:86e94505ed24ea06514883fd44d2bc02d90e77e7979c8eb71b90f41d364a1bad", size = 85385, upload-time = "2025-04-11T14:42:46.661Z" }
sdist = { url = "https://files.pythonhosted.org/packages/06/94/82699a10bca87a5556c9c59b5963f2d039dbd239f25bc2a63907a05a14cb/httpcore-1.0.9.tar.gz", hash = "sha256:6e34463af53fd2ab5d807f399a9b45ea31c3dfa2276f15a2c3f00afff6e176e8", size = 85484, upload-time = "2025-04-24T22:06:22.219Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/18/8d/f052b1e336bb2c1fc7ed1aaed898aa570c0b61a09707b108979d9fc6e308/httpcore-1.0.8-py3-none-any.whl", hash = "sha256:5254cf149bcb5f75e9d1b2b9f729ea4a4b883d1ad7379fc632b727cec23674be", size = 78732, upload-time = "2025-04-11T14:42:44.896Z" },
{ url = "https://files.pythonhosted.org/packages/7e/f5/f66802a942d491edb555dd61e3a9961140fd64c90bce1eafd741609d334d/httpcore-1.0.9-py3-none-any.whl", hash = "sha256:2d400746a40668fc9dec9810239072b40b4484b640a8c38fd654a024c7a1bf55", size = 78784, upload-time = "2025-04-24T22:06:20.566Z" },
]
[[package]]