Skip to content

fix: resolve all 11 Dependabot security alerts#27

Merged
bakerboy448 merged 1 commit intodevelopfrom
fix/dependabot-vulnerabilities
Mar 1, 2026
Merged

fix: resolve all 11 Dependabot security alerts#27
bakerboy448 merged 1 commit intodevelopfrom
fix/dependabot-vulnerabilities

Conversation

@bakerboy448
Copy link
Collaborator

@bakerboy448 bakerboy448 commented Mar 1, 2026

Summary

  • Bumps all pinned dependencies to resolve all 11 open Dependabot alerts
  • Flask 2.2.5 → 3.1.3 (major bump — app uses only basic routing/jsonify, no breaking changes)
  • Werkzeug 3.0.2 → 3.1.6 (5 CVEs: safe_join, debugger RCE, resource exhaustion)
  • Jinja2 3.1.4 → 3.1.6 (3 CVEs: sandbox breakout via filenames/format/attr)
  • requests 2.32.0 → 2.32.4 (.netrc credential leak)
  • Adds blinker 1.9.0 (new Flask 3.x requirement)
  • Bumps itsdangerous, click, MarkupSafe to Flask 3.x compatible versions

Resolves #4, #7, #8, #10, #11, #12, #13, #14, #15, #16, #17

Test plan

  • Docker image builds successfully
  • /update-dns?guid=<test> endpoint responds correctly
  • All 11 Dependabot alerts auto-close after merge

Summary by CodeRabbit

Release Notes

  • Chores
    • Updated core framework and library dependencies to latest stable versions to improve application stability, security, and compatibility.

- Flask 2.2.5 → 3.1.3 (session Vary header, low)
- Werkzeug 3.0.2 → 3.1.6 (safe_join device names, debugger RCE, resource exhaustion)
- Jinja2 3.1.4 → 3.1.6 (sandbox breakout via filenames/format/attr)
- requests 2.32.0 → 2.32.4 (.netrc credential leak)
- itsdangerous 2.1.2 → 2.2.0 (Flask 3.x requirement)
- click 8.1.7 → 8.1.8
- MarkupSafe 2.1.5 → 3.0.2
- Add blinker 1.9.0 (Flask 3.x requirement)

Resolves: #4, #7, #8, #10, #11, #12, #13, #14, #15, #16, #17
@coderabbitai
Copy link

coderabbitai bot commented Mar 1, 2026

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

📥 Commits

Reviewing files that changed from the base of the PR and between dcb4f5e and 5de0b3e.

📒 Files selected for processing (1)
  • requirements.txt
 _____________________________________________________________________________________________________________________
< Use a project glossary. Create and maintain a single source of all the specific terms and vocabulary for a project. >
 ---------------------------------------------------------------------------------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

✏️ Tip: You can disable in-progress messages and the fortune message in your review settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch fix/dependabot-vulnerabilities

Comment @coderabbitai help to get the list of available commands and usage tips.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

1 participant