chore: bump aiohttp and fonttools to resolve CVE findings - #269
Open
juanCm1ra wants to merge 1 commit into
Open
Conversation
Resolves CRITICAL findings from vuln scan (lappocr image): - fonttools 4.53.0 -> 4.60.2 (transitive, via matplotlib) - CVE-2025-66034 - aiohttp 3.9.5 -> 3.13.5 (CVE-2025-62718). Could not reach the fixed_version 3.14.1 from the scan: aiohttp>=3.14 requires Python>=3.10, and this SDK supports python>=3.9,<4.0. 3.13.5 is the highest version compatible with the current Python floor. Only poetry.lock changed (pyproject.toml range already allowed this resolution). GitPython, also flagged in the scan, is not a dependency of this project at all (direct or transitive) - false positive, not touched.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
fonttools4.53.0 -> 4.60.2 (transitive, via matplotlib) — resolves CVE-2025-66034.aiohttp3.9.5 -> 3.13.5 — resolves CVE-2025-62718. Could not reach thefixed_versionfrom the scan (3.14.1):aiohttp>=3.14requires Python>=3.10, and this SDK'spyproject.tomlsupportspython>=3.9,<4.0. 3.13.5 is the highest version in the 3.9-compatible line.poetry.lockchanged — the existingpyproject.tomlrange (aiohttp>=3.7.3,<4.0.0) already allowed this resolution, so no manifest edit was needed.GitPython, also flagged in the original scan for this image (lappocr), is not a dependency of this project at all (confirmed via grep across pyproject.toml/poetry.lock) — treating as a scanner false positive, not touched here.Source: internal vulnerability scan findings for the
lappocrimage (built from this SDK viaexamples/apps/ocr+infra-cli gen-st-app).Follow-up (not in this PR)
To fully match the scan's
aiohttpfixed_version (3.14.1), the project's Python floor would need to go from>=3.9to>=3.10— that's a breaking change for consumers of this SDK and needs a separate, deliberate decision.Test plan
poetry installresolves cleanly from this lockfilelappocrStreamlit demo image still builds and runs OCR inference correctly🤖 Generated with [Claude Code]