[ROMzombie]

Dependency Update and Security Review (2026-10-22)

Summary of Updates

This PR reviews project dependencies, scans for known security vulnerabilities and outdated versions, upgrades compatible direct and transitive dependencies to their latest releases, patches critical CVEs in Pillow and Certifi, and verifies the full test suite.

Dependency Audit

Direct Dependencies (requirements.txt)

Package	Previous Pin	Upgraded Pin	Installed Version	Category	Security Status
fastapi	>=0.143.0	>=0.161.1	0.161.1	Minor	0 CVEs
pillow	>=12.3.0	>=13.0.0	13.0.0	Major	0 CVEs (Patched 39 CVEs)
playwright	>=1.63.0	>=1.64.1	1.64.1	Minor	0 CVEs
uvicorn[standard]	>=0.54.0	>=0.54.0	0.54.0	Up to date	0 CVEs
httpx	>=0.28.1	>=0.28.1	0.28.1	Up to date	0 CVEs
pydantic	>=2.14.1	>=2.14.1	2.14.1	Up to date	0 CVEs
python-multipart	>=0.0.32	>=0.0.32	0.0.32	Up to date	0 CVEs
gradio_client	>=2.7.2	>=2.7.2	2.7.2	Up to date	0 CVEs
python-dotenv	>=1.2.4	>=1.2.4	1.2.4	Up to date	0 CVEs

Transitive Dependencies Upgraded (Safe Minor/Patch)

Package	Previous Version	Upgraded Version	Category	Dependency Of
certifi	2026.7.22	2026.10.19	Patch	httpx (Patched 2 CVEs: GHSA-6q48-6c7w-9gw2, PYSEC-2026-4320)
starlette	1.7.0	1.9.0	Minor	fastapi
pydantic-core	2.46.5	2.50.1	Minor	pydantic
httptools	0.8.0	0.9.0	Minor	uvicorn[standard]
websockets	17.2	17.3	Minor	uvicorn[standard]
pypdf	6.21.1	6.21.2	Patch	internal tooling
hf-xet	1.6.0	1.7.0	Minor	huggingface-hub
pyee	13.0.1	14.0.0	Minor	playwright
huggingface_hub	1.28.0 / 1.29.0	1.33.0	Minor	gradio_client
filelock	3.32.3 / 3.32.4	3.32.7	Patch	huggingface_hub
pip	26.2.1	26.2.2	Patch	build environment

Upgrades Skipped / Constrained by Upstream Packages

Package	Current Version	Available	Reason Skipped
huggingface_hub	1.33.0	2.2.0 (Major)	Major v2.0 release replaces internal HTTP transport with httpx2, introducing breaking changes with gradio_client 2.7.2. Maintained at latest stable 1.x (1.33.0).
filelock	3.32.7	4.2.4 (Major)	Constrained by huggingface_hub 1.x compatibility. Maintained at latest stable 3.x (3.32.7).
pyee	14.0.0	15.0.0 (Major)	Constrained by playwright 1.64.1 requirement (pyee<15,>=13). Maintained at latest compatible release (14.0.0).

Security Findings & Vulnerability Scan

• OSV Database Scan: Queried Open Source Vulnerability (OSV) API across all installed packages. Result: 0 known vulnerabilities remaining.
• Vulnerabilities Remediated:
  • Pillow 12.3.0 -> 13.0.0: Patched 39 CVEs (including buffer overflows, DoS recursion, and heap corruption issues).
  • certifi 2026.7.22 -> 2026.10.19: Patched GHSA-6q48-6c7w-9gw2 / PYSEC-2026-4320 (compromised emSign intermediate CA keys).
• GitHub Dependabot Scan: Queried repository pull requests and alerts. Result: 0 open Dependabot pull requests, 0 alerts.

Verification & Quality Gates

• Full Test Suite:
  • tests/test_proxies.py, tests/test_grok.py, tests/test_janus.py, tests/test_api.py, tests/test_pipeline.py, tests/test_samples.py, tests/test_notify_discord.py, tests/test_perchance.py: 78 / 78 passed (100% OK).
• Dependency Consistency: pip check reports No broken requirements found across all workspace environments.
• Compilation Check: python -m compileall backend tests passed with 0 errors.