fix: security vulnerabilities + dep updates#4
Merged
Conversation
- Bump litellm 1.0.0 → >=1.61.15 (14 CVEs including CVE-2025-0628, CVE-2024-2952, CVE-2024-4888, CVE-2024-5751, CVE-2026-35029) - Bump aiohttp 3.9.5 → >=3.13.4 (20 CVEs including CVE-2026-34515 through CVE-2026-34525, CVE-2024-52304, CVE-2025-69223 series) - Bump python-dotenv 1.0.1 → >=1.2.2 (CVE-2026-28684) - Bump anthropic 0.19.1 → >=0.49.0 (outdated, unpinned for flexibility) - Bump pydantic 2.8.2 → >=2.10.6 (security hardening) - Raise aiohttp lower bound in examples/arcade-dev to >=3.13.4 - Fix NameError in CacheValidator.auto_repair_cache: returned undefined freed_space instead of the repair_summary dict that was built - Remove unreachable logger.debug() statement after return True in DatabaseManager._is_valid_table_name (dead code / F821) Co-Authored-By: claude-flow <ruv@ruv.net>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR fixes real bugs and addresses 35+ known CVEs across the dependency tree. No cosmetic changes.
Code Bugs Fixed
src/cache/validation.py— NameError crash inauto_repair_cacheauto_repair_cache()returned the undefined namefreed_spaceinstead of therepair_summarydict it builds during the repair loop. Any call to this method raisesNameError: name 'freed_space' is not defined.repair_summary.src/db/connection.py— Unreachable dead code in_is_valid_table_namelogger.debug(...)call appeared afterreturn True, making it permanently unreachable. Leftover from a refactor; caused flake8 F821 noise.Vulnerable Dependencies
requirements.txtlitellm1.0.0>=1.61.15aiohttp3.9.5>=3.13.4python-dotenv1.0.1>=1.2.2anthropic0.19.1>=0.49.0pydantic2.8.2>=2.10.6Pin style changed from
==to>=for core deps so security patches flow through without a manual edit.examples/arcade-dev/requirements.txtaiohttp>=3.8.0lower bound covered vulnerable versions; raised to>=3.13.4.Verification
Test plan
pip install -r requirements.txtresolves without conflictspip-audit -r requirements.txtreports no known vulnerabilitiesCacheValidator.auto_repair_cache()with a populatedValidationResult— confirm it returns a dict instead of raisingNameErrorDatabaseManager._is_valid_table_name()still returnsTrue/Falsecorrectly for valid and invalid names🤖 Generated with claude-flow