fix: patch 4 Vanta security vulnerabilities (critical, medium, low)#687
fix: patch 4 Vanta security vulnerabilities (critical, medium, low)#687Harigithub11 wants to merge 6 commits intomainfrom
Conversation
…vulnerability Updated nltk from 3.9.2 to 3.9.3 Links: - https://app.vanta.com/c/potpie.ai/vulnerabilities/findings-by-vulnerability?source=github&severity=CRITICAL - https://github.com/potpie-ai/potpie/security/dependabot/87
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughUpdated dependency declarations: added Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Updated langgraph from 1.0.7 to 1.0.10 to patch unsafe msgpack checkpoint deserialization Links: - https://app.vanta.com/c/potpie.ai/vulnerabilities/findings-by-vulnerability?source=github&severity=MEDIUM
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@pyproject.toml`:
- Line 35: Update the requirements.txt pin for langgraph to match the
security-bumped constraint in pyproject.toml by replacing the hard pin
langgraph==1.0.7 (currently pulled in via langchain==1.2.8) with a constraint
that allows >=1.0.10 (e.g., change the explicit langgraph entry or update the
langchain dependency to a version that depends on langgraph>=1.0.10); ensure the
final requirements line(s) reference langgraph>=1.0.10 so installations from
requirements.txt receive the patched langgraph version.
- Line 40: The pyproject change to "nltk>=3.9.3" introduces a regression that
blocks extraction from symlinked directories (see GH `#3509`); before deploying,
verify any code that extracts NLTK resources from symlinked paths by running the
exact extraction flows (e.g., calls that use nltk.download, nltk.data.path
manipulations, or package resource extraction) against symlinked directories and
add an automated test that exercises those paths; if extraction fails, revert or
pin the dependency to the prior working version (change the "nltk>=3.9.3" spec
in pyproject.toml) or hold the bump until the upstream fix is released.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: cf60d1bb-8196-4896-8b49-5279c0e08a7a
⛔ Files ignored due to path filters (1)
uv.lockis excluded by!**/*.lock
📒 Files selected for processing (1)
pyproject.toml
Updated tornado from 6.5.4 to 6.5.5 to patch cookie validation bypass in set_cookie Links: - https://app.vanta.com/c/potpie.ai/vulnerabilities/findings-by-vulnerability?source=github&severity=MEDIUM
Updated langchain-core from 1.2.8 to 1.2.18 to patch SSRF via image_url in token counting Links: - https://app.vanta.com/c/potpie.ai/vulnerabilities/findings-by-vulnerability?source=github&severity=LOW
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@pyproject.toml`:
- Line 36: Add a short note to the PR description documenting the added
dependency constraint "tornado>=6.5.5" and cite CVE-2026-31958 (DoS via
excessive multipart/form-data parts in Tornado <= 6.5.4) so reviewers/auditors
can see the justification; include the CVE identifier and a one-line reason
(e.g., mitigation of DoS in multipart/form-data handling) and mention that the
constraint upgrades Tornado to 6.5.5 or later.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: ff547923-fc3f-47a6-bb55-1c0eb8685981
⛔ Files ignored due to path filters (1)
uv.lockis excluded by!**/*.lock
📒 Files selected for processing (1)
pyproject.toml
| "langchain>=1.0.3", | ||
| "langchain-core>=1.2.11", | ||
| "litellm>=1.80", | ||
| "tornado>=6.5.5", |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
tornado 6.5.5 security vulnerability CVE fix
💡 Result:
Apache Tornado 6.5.5 fixes CVE-2026-31958 (DoS via excessive multipart/form-data parts). Versions <= 6.5.4 are affected; 6.5.5 is the patched release. The fix adds new multipart limits (default 100 parts/request), configurable via tornado.httputil.ParseMultipartConfig, and allows disabling multipart parsing if your app doesn’t need it. [1][2]
Upgrade (pip):
python -m pip install -U "tornado>=6.5.5"Sources:
[1] GitHub Security Advisory GHSA-qjxf-f2mg-c6mc (CVE-2026-31958)
[2] OpenCVE record for CVE-2026-31958
Ensure tornado>=6.5.5 is documented in the PR description.
This dependency fixes CVE-2026-31958 (DoS via excessive multipart/form-data parts in Tornado <= 6.5.4). The constraint is justified, but add this CVE reference to the PR description for audit trail clarity.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@pyproject.toml` at line 36, Add a short note to the PR description
documenting the added dependency constraint "tornado>=6.5.5" and cite
CVE-2026-31958 (DoS via excessive multipart/form-data parts in Tornado <= 6.5.4)
so reviewers/auditors can see the justification; include the CVE identifier and
a one-line reason (e.g., mitigation of DoS in multipart/form-data handling) and
mention that the constraint upgrades Tornado to 6.5.5 or later.
Harigithub11
changed the title
CVE-2026-33231 affects nltk <= 3.9.3. Upgrading to 3.9.4 resolves it. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- CVE-2026-34070, CVE-2026-26013: langchain-core 1.2.8 → 1.2.23 - CVE-2026-28490, CVE-2026-28498, CVE-2026-28802, CVE-2026-27962: authlib 1.6.6 → 1.6.9 - CVE-2026-32597: pyjwt 2.11.0 → 2.12.1 - CVE-2026-30922: pyasn1 0.6.2 → 0.6.3 - CVE-2026-25645: requests 2.32.5 → 2.33.1 - CVE-2026-34073: cryptography 46.0.5 → 46.0.6 - CVE-2026-4539: pygments 2.19.2 → 2.20.0
|
|
Closing in favour of a new clean PR without merge conflicts. |
1 participant
Patched 4 vulnerabilities flagged by Vanta across critical, medium, and low severity.
Changes:
Links:
Summary by CodeRabbit