vulncheck
b2da0c4261
python:3.14-slim is the newest base the requirements install on with --only-binary: 3.15 is out, but xmlsec (python3-saml) and pyyaml (uvicorn[standard]) publish no cp315 wheels yet. The local test venv already runs 3.14, so tests and image now match. Pins without cp314 wheels moved: pydantic 2.10.5 -> 2.13.5 (pydantic-core 2.27 has none, 2.13.5 is what the tests run), psycopg2-binary 2.9.10 -> 2.9.13, sqlalchemy 2.0.36 -> 2.0.52 (2.0.36 fell back to the pure-Python wheel, without the C extensions). Python 3.13+ sets VERIFY_X509_STRICT in ssl.create_default_context(): an internal CA without keyUsage, or a server certificate without Authority Key Identifier, fails there although 3.11 accepted it. ca_trust_service clears the flag for the process (create_default_context for httpx, _create_default_https_context for pyVmomi and urllib), so integrations against older internal PKIs keep working after the upgrade. The test talks real TLS to a server whose legacy CA has neither extension.
77 lines
2.2 KiB
Plaintext
77 lines
2.2 KiB
Plaintext
# VulnManager Dependencies (Python 3.14 kompatibel)
|
|
|
|
# FastAPI & Server
|
|
# fastapi 0.115.6 hat starlette auf <0.42 festgenagelt — und genau dort
|
|
# hingen 14 Advisories. Die Starlette-Aktualisierung geht nur über fastapi.
|
|
fastapi==0.141.1
|
|
uvicorn[standard]==0.32.1
|
|
python-multipart==0.0.32
|
|
|
|
# Database
|
|
sqlalchemy==2.0.52 # erste cp314-Wheels (C-Extensions); 2.0.36 fiel auf py3-none-any zurück
|
|
alembic==1.14.0
|
|
psycopg2-binary==2.9.13 # erste Wheels für 3.14 ab 2.9.11; 2.9.13 auch für 3.15
|
|
|
|
# Authentication & Security
|
|
pyjwt[crypto]==2.15.1
|
|
bcrypt==5.0.0 # direkt genutzt (app/auth/jwt_handler.py); passlib ist raus
|
|
|
|
# HTTP Clients
|
|
httpx==0.28.1 # Updated
|
|
tenacity==9.0.0 # Updated
|
|
|
|
# Rate Limiting
|
|
slowapi==0.1.9
|
|
|
|
# Validation
|
|
pydantic==2.13.5 # pydantic-core 2.27 hat keine cp314-Wheels; 2.13.5 läuft lokal
|
|
pydantic-settings==2.7.1 # Updated
|
|
email-validator==2.2.0 # Updated
|
|
|
|
# Scheduling
|
|
apscheduler==3.10.4
|
|
|
|
# Environment
|
|
python-dotenv==1.2.2
|
|
|
|
# Logging & Monitoring (optional)
|
|
python-json-logger==3.2.1 # Updated
|
|
|
|
# Testing (Development)
|
|
pytest==9.1.1
|
|
pytest-asyncio==1.4.0 # verlangt pytest>=8.4
|
|
|
|
# Reporting
|
|
reportlab==4.4.9
|
|
|
|
# ============================================
|
|
# Multi-provider authentication (Phase 1: foundation; Phase 2+: LDAP/OIDC/SAML)
|
|
# ============================================
|
|
# TOTP / MFA
|
|
pyotp==2.9.0
|
|
# Fernet for encrypting LDAP bind-pw + TOTP secrets at rest
|
|
cryptography==50.0.0
|
|
|
|
# LDAPS (Phase 2)
|
|
ldap3==2.9.1
|
|
|
|
# OAuth2 / OIDC (Phase 3)
|
|
authlib==1.7.2
|
|
itsdangerous==2.2.0
|
|
|
|
# SAML 2.0 (Phase 4) — xmlsec / lxml wheels bundle libxml2 + xmlsec1, no system libs
|
|
python3-saml==1.16.0
|
|
# lxml parst hier NICHT die Advisory-Feeds (die laufen über stdlib
|
|
# xml.etree.ElementTree), sondern Microsoft-HTML in m365_service.py.
|
|
lxml==6.1.1
|
|
|
|
# Microsoft product-lifecycle EOL export parsing (Plan O) — reads the
|
|
# monthly eos-product-listing .xlsx from download.microsoft.com.
|
|
openpyxl==3.1.5
|
|
|
|
# VMware vSphere inventory (vCenter connector). Broadcom's own SDK, and the
|
|
# only practical way to read a per-host BUILD number: the vCenter REST API's
|
|
# /api/vcenter/host returns name and power state and no version at all, while
|
|
# every VMware advisory states its fix as a build ("ESXi80U3k-25595708").
|
|
pyvmomi==9.1.0.0
|