[A-08] Python dependency hygiene #44

New issue

Open

opened 2026-10-11 20:15:35 -05:00 by pyaniz · 0 comments

pyaniz commented

2026-10-11 20:15:35 -05:00

Owner

Audit ID: A-08 · Priority: P2 · Effort: S

Python dependency hygiene. fastapi==0.109.0 is old (it pins an old Starlette with known CVEs) while everything else is unpinned. There is no lock file. passlib[bcrypt] and requests are not imported anywhere. Action: pin and lock, remove unused packages, add pip-audit/npm audit.

Source: AUDIT_FINDINGS.md (audit 2026-10-11). Items marked (verify) need confirming first.

**Audit ID:** A-08 · **Priority:** P2 · **Effort:** S **Python dependency hygiene.** `fastapi==0.109.0` is old (it pins an old Starlette with known CVEs) while everything else is unpinned. There is no lock file. `passlib[bcrypt]` and `requests` are not imported anywhere. **Action:** pin and lock, remove unused packages, add `pip-audit`/`npm audit`. Source: `AUDIT_FINDINGS.md` (audit 2026-10-11). Items marked *(verify)* need confirming first.

pyaniz added the

audit

security

labels

2026-10-11 20:15:35 -05:00

pyaniz referenced this issue

2026-10-24 18:27:32 -05:00

Fix: upgrade backend and frontend dependencies (1.37.4, 1.37.5) #93