 Juan Denis
|
9604e1ea66
|
Add Bandit + Safety security scanning to CI and fix vulnerable deps
- Add .github/workflows/security-scan.yml with Bandit SAST and Safety
dependency scanning (requires SAFETY_API_KEY secret)
- Add backend/.bandit config to skip expected noise (B404, B603, B607)
- Update vulnerable dependencies:
gunicorn 21.2.0 → 22.0.0 (CVE-2024-1135 HTTP smuggling)
gevent 23.9.1 → 25.4.2 (HTTP smuggling + race condition)
python-socketio 5.10.0 → 5.14.0 (CVE-2025-61765 deserialization)
cryptography 42.0.0 → 44.0.3 (multiple CVEs)
requests 2.31.0 → 2.32.5 (vulnerability fixes)
Flask-Cors 4.0.0 → 5.0.1, Flask-SocketIO 5.3.6 → 5.4.1
python-engineio 4.8.1 → 4.11.2
- Pin previously unpinned deps: schedule, passlib, bcrypt
|
2026-02-11 23:06:14 -05:00 |
|