[Snyk] Fix for 3 vulnerabilities by mrayanasim09 · Pull Request #96 · mrayanasim09/python-projects

mrayanasim09 · 2026-08-13T00:54:59Z

Snyk has created this PR to fix 3 vulnerabilities in the pip dependencies of this project.

Snyk changed the following file(s):

requirements.txt

⚠️

Warning

yfinance 1.5.2 requires curl-cffi, which is not installed.
yfinance 1.5.2 requires protobuf, which is not installed.
yfinance 1.5.2 requires websockets, which is not installed.
textblob 0.17.1 requires nltk, which is not installed.
requests 2.31.0 requires urllib3, which is not installed.
PyQtWebEngine 5.15.6 requires PyQt5, which is not installed.
prophet 1.3.0 requires holidays, which is not installed.
matplotlib 3.5.3 requires fonttools, which is not installed.
fastapi 0.103.2 requires starlette, which is not installed.

Breaking Change Risk

Notice: This assessment is enhanced by AI.

Important

Check the changes in this PR to ensure they won't cause issues with your project.
Max score is 1000. Note that the real score may have changed since the PR was raised.
This PR was automatically created by Snyk using the credentials of a real user.
Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the affected dependencies could be upgraded.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Directory Traversal
🦉 Regular Expression Denial of Service (ReDoS)
🦉 Allocation of Resources Without Limits or Throttling

This change is

The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-NLTK-17817780 - https://snyk.io/vuln/SNYK-PYTHON-STARLETTE-13733964 - https://snyk.io/vuln/SNYK-PYTHON-STARLETTE-8186175

mrayanasim09 · 2026-08-13T00:55:00Z

This update includes a medium-risk upgrade for starlette and a medium-risk upgrade for nltk.

starlette@0.27.0 → starlette@0.49.1

Risk: Medium

This upgrade spans multiple minor versions and introduces a significant breaking change related to Python version compatibility.

Python Version Requirement: Support for Python 3.7 was dropped in version 0.30.0, and support for Python 3.8 was dropped in 0.45.0. The target version 0.49.1 and later require Python 3.9 or newer. Applications running on older Python versions will need to upgrade their environment.
Security Fixes: This upgrade incorporates several security patches released after 0.27.0, including fixes for a denial-of-service issue (0.40.0) and a Range header parsing vulnerability (0.49.1).

Recommendation: Verify that your production environment and development workflows are running on Python 3.9 or a more recent version before applying this upgrade.

Source: Starlette Changelog, EOL Information

nltk@3.8.1 → nltk@3.10.0

Risk: Medium

This upgrade introduces a significant behavioral change related to security policy.

Stricter Security Policy: Version 3.10.0 enforces a stricter security policy (nltk.pathsec) by default. This change hardens resource loading against path traversal and other potential vulnerabilities. While this is a positive security enhancement, it may affect applications that load NLTK data from custom or non-standard paths.

Recommendation: After upgrading, test any functionality that loads NLTK resources (e.g., tokenizers, corpora, models) to ensure it is not impacted by the new security constraints. Review the NLTK documentation for the new security model if you encounter issues.

Source: NLTK ChangeLog

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

vercel · 2026-08-13T00:55:01Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
python-projects	Ready	Preview	Aug 13, 2026 12:55am
python-projects-rqac	Ready	Preview	Aug 13, 2026 12:55am

codesandbox · 2026-08-13T00:55:02Z

Review or Edit in CodeSandbox

Open the branch in Web Editor • VS Code • Insiders

Open Preview

coderabbitai · 2026-08-13T00:55:10Z

Important

Review skipped

Ignore keyword(s) in the title.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a6721286-590e-4aab-89e5-4c2f7e7c7f22

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

netlify · 2026-08-13T00:55:15Z

❌ Deploy Preview for heroic-strudel-239c3c failed. Why did it fail? →

Name	Link
🔨 Latest commit	`d86a754`
🔍 Latest deploy log	https://app.netlify.com/projects/heroic-strudel-239c3c/deploys/6a7d15e64c2ec500080398e5

guardrails · 2026-08-13T00:55:19Z

⚠️ We detected 10 security issues in this pull request:

Vulnerable Libraries (10)

Severity	Details
High	pkg:pypi/fastapi@0.95.0 upgrade to: 0.109.1
Medium	pkg:pypi/fonttools@4.43.0 upgrade to: 4.60.2
Critical	pkg:pypi/numpy@0.0.0 upgrade to: 1.16.1
N/A	pkg:pypi/opencv-python@0.0.0 upgrade to: 4.8.1.78
High	pkg:pypi/openpyxl@0.0.0 upgrade to: 2.4.2
High	pkg:pypi/pillow@0.0.0 upgrade to: 12.3.0
N/A	pkg:pypi/protobuf@4.25.8 upgrade to: 5.29.6,6.33.5
High	pkg:pypi/requests@0.0.0 upgrade to: c45d7c49ea75133e52ab22a8e9e13173938e36ff,2.20.0
Low	pkg:pypi/starlette@0.49.1 upgrade to: 1.3.0
Medium	pkg:pypi/urllib3@2.5.0 upgrade to: 2.7.0

More info on how to fix Vulnerable Libraries in Python.

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

netlify · 2026-08-13T00:55:19Z

❌ Deploy Preview for joyful-gelato-ff27ed failed. Why did it fail? →

Name	Link
🔨 Latest commit	`d86a754`
🔍 Latest deploy log	https://app.netlify.com/projects/joyful-gelato-ff27ed/deploys/6a7d15e61ac5d7000814c40e

codacy-production · 2026-08-13T00:55:40Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric Results

Complexity 0

Duplication 0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

socket-security · 2026-08-13T00:55:50Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/pygame@2.6.1
	pypi/pyttsx3@2.99
	pypi/tkcalendar@1.6.1
	pypi/pyqt5@5.15.11
	pypi/pyqtwebengine@5.15.7
	pypi/opencv-python@5.0.0.93
	pypi/mediapipe@1.0.0
	pypi/pytube@15.0.0
	pypi/screen-brightness-control@0.27.2
	pypi/prophet@1.3.0
	pypi/winapps@0.2.0
	pypi/pyautogui@0.9.54
	pypi/starlette@1.6.0

View full report

fix: requirements.txt to reduce vulnerabilities

d86a754

The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-NLTK-17817780 - https://snyk.io/vuln/SNYK-PYTHON-STARLETTE-13733964 - https://snyk.io/vuln/SNYK-PYTHON-STARLETTE-8186175

mrayanasim09 requested a review from drik-493 as a code owner August 13, 2026 00:55

pull-request-size Bot added the size/M label Aug 13, 2026

vercel Bot deployed to Preview – python-projects August 13, 2026 00:55 View deployment

vercel Bot deployed to Preview – python-projects-rqac August 13, 2026 00:55 View deployment

Navigation Menu

Uh oh!

[Snyk] Fix for 3 vulnerabilities - #96

[Snyk] Fix for 3 vulnerabilities#96
mrayanasim09 wants to merge 1 commit into
mainfrom
snyk-fix-f79ca4bcac5e447b4085a6951e8e831f

mrayanasim09 commented Aug 13, 2026 •

edited

Loading

Uh oh!

mrayanasim09 commented Aug 13, 2026

Uh oh!

vercel Bot commented Aug 13, 2026 •

edited

Loading

Uh oh!

codesandbox Bot commented Aug 13, 2026

Uh oh!

coderabbitai Bot commented Aug 13, 2026

Review skipped

Uh oh!

netlify Bot commented Aug 13, 2026 •

edited

Loading

Uh oh!

guardrails Bot commented Aug 13, 2026

Uh oh!

netlify Bot commented Aug 13, 2026 •

edited

Loading

Uh oh!

codacy-production Bot commented Aug 13, 2026

Uh oh!

socket-security Bot commented Aug 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

mrayanasim09 commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Snyk has created this PR to fix 3 vulnerabilities in the pip dependencies of this project.

Snyk changed the following file(s):

Breaking Change Risk

Uh oh!

mrayanasim09 commented Aug 13, 2026

starlette@0.27.0 → starlette@0.49.1

nltk@3.8.1 → nltk@3.10.0

Uh oh!

vercel Bot commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codesandbox Bot commented Aug 13, 2026

Review or Edit in CodeSandbox

Uh oh!

coderabbitai Bot commented Aug 13, 2026

Review skipped

Uh oh!

netlify Bot commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ Deploy Preview for heroic-strudel-239c3c failed. Why did it fail? →

Uh oh!

guardrails Bot commented Aug 13, 2026

Uh oh!

netlify Bot commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ Deploy Preview for joyful-gelato-ff27ed failed. Why did it fail? →

Uh oh!

codacy-production Bot commented Aug 13, 2026

Up to standards ✅

Uh oh!

socket-security Bot commented Aug 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mrayanasim09 commented Aug 13, 2026 •

edited

Loading

vercel Bot commented Aug 13, 2026 •

edited

Loading

netlify Bot commented Aug 13, 2026 •

edited

Loading

netlify Bot commented Aug 13, 2026 •

edited

Loading