From 029fbbf3c359f3ef020c64ff20e1c2666006b895 Mon Sep 17 00:00:00 2001 From: RockChinQ Date: Mon, 26 Oct 2026 14:20:16 +0800 Subject: [PATCH] fix(deps): raise the python-multipart floor to the locked version (#2773) The declared floor was python-multipart>=0.0.27 while uv.lock resolves 0.0.32. 0.0.27 falls inside four published advisories, so any resolve that honours the floor rather than the lock can land on a vulnerable release: - GHSA-5rvq-cxj2-64vf / GHSA-6jv3-5f52-599m / GHSA-vffw-93wf-4j4q (quadratic-time querystring DoS, semicolon field-separator and Content-Disposition parameter smuggling), fixed in 0.0.30 - GHSA-v9pg-7xvm-68hf (negative Content-Length buffers the entire body), fixed in 0.0.31 The locked 0.0.32 has no known advisories. Raising the floor to match the lock costs nothing and keeps the two from drifting apart. Reachability, for the record: multipart parsing happens on the skills and plugin local-upload routes, both of which require USER_TOKEN_OR_API_KEY with RESOURCE_MANAGE, so this is an authenticated-admin DoS rather than an anonymous one. The resolved version is unchanged; only the requirement metadata moves. Co-authored-by: multica-agent --- pyproject.toml | 2 +- uv.lock | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index dc0518418..c2f8212ea 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -66,7 +66,7 @@ dependencies = [ "langchain>=1.3.9", "langchain-core>=1.3.3", "langsmith>=0.8.18", - "python-multipart>=0.0.27", + "python-multipart>=0.0.32", "Mako>=1.4.2", "langchain-text-splitters>=1.1.2", "chromadb>=1.0.0,<2.0.0", diff --git a/uv.lock b/uv.lock index 3f1e83f19..438c635d3 100644 --- a/uv.lock +++ b/uv.lock @@ -2272,7 +2272,7 @@ requires-dist = [ { name = "pypdf", specifier = ">=6.0.0" }, { name = "pyseekdb", marker = "extra == 'seekdb'", specifier = "==1.4.0.post1" }, { name = "python-docx", specifier = ">=1.1.0" }, - { name = "python-multipart", specifier = ">=0.0.27" }, + { name = "python-multipart", specifier = ">=0.0.32" }, { name = "python-socks", specifier = ">=2.7.1" }, { name = "python-telegram-bot", specifier = ">=22.0" }, { name = "pyyaml", specifier = ">=6.0.2" },