diff --git a/backend/pyproject.toml b/backend/pyproject.toml index 9b6d366..de9c436 100644 --- a/backend/pyproject.toml +++ b/backend/pyproject.toml @@ -10,33 +10,33 @@ description = "NetPlanner backend — AI-powered network business decision-suppo requires-python = ">=3.12" dependencies = [ # --- Web framework --- - "fastapi==0.138.1", - "uvicorn[standard]==0.49.0", + "fastapi==0.141.1", + "uvicorn[standard]==0.52.1", # Pinned >=1.0.1 to fix PYSEC-2026-161 (DoS via Content-Type header in # MultiPartParser). 1.3.1 fixes GHSA-82w8-qh3p-5jfq (form() limit DoS) and # GHSA-jp82-jpqv-5vv3 (host poisoning). fastapi 0.136.3 requires # starlette>=0.46.0 (no upper bound), so 1.3.1 is compatible. - "starlette==1.3.1", + "starlette==1.5.0", # --- Database (async SQLite) --- "SQLAlchemy==2.0.49", "aiosqlite==0.22.1", - "alembic==1.18.5", - "greenlet==3.5.2", + "alembic==1.19.0", + "greenlet==3.5.4", # --- Validation / settings --- "pydantic==2.13.4", # 2.14.2 fixes GHSA-4xgf-cpjx-pc3j (NestedSecretsSettingsSource symlink # escape). Not reachable here (env_file only, no secrets_dir) but patched. - "pydantic-settings==2.14.2", + "pydantic-settings==2.15.0", "python-dotenv==1.2.2", # --- AI layer --- - "anthropic==0.112.0", + "anthropic==0.121.0", # Provider-agnostic routing for the multi-provider eval (NVIDIA NIM via the # `nvidia_nim/` provider). The default path stays native Anthropic; LiteLLM # is only exercised when `provider=nvidia_nim`. Pinned exact (SEC-30). - "litellm==1.89.4", + "litellm==1.95.0", # --- PDF generation --- "weasyprint==69.0", - "markdown==3.10.2", + "markdown==3.10.3", # Whitelist-based HTML sanitizer for Advisor-authored markdown rendered # into PDF reports (defends against