peter
8ffa65a9da
gate / frontend (push) Successful in 54s
gate / backend (push) Successful in 1m36s
The pip-audit step added in E1 S4 flagged cryptography 46.0.7 for PYSEC-2026-3552 /3553/3554 and GHSA-537c-gmf6-5ccf; all are fixed by 50.0.0. The requirements.txt ceiling `<47` was blocking the upgrade — relaxed to `>=50.0.0,<51`. The lock is a surgical bump (only the cryptography line changed; cffi 2.1.1 already satisfies it, no other package moved). pip-audit -r requirements.lock is now clean. Add tests/test_security.py (there was none for the crypto primitives): the Fernet encrypt/decrypt round-trip, decrypt_optional degrading on garbage and on a key mismatch (the B-core-2 path), and the argon2 password hash/verify round-trip — so a future crypto-lib bump can't silently break the token-at-rest path. Gate green: 330 pytest.
25 lines
1010 B
Plaintext
25 lines
1010 B
Plaintext
fastapi>=0.115,<1.0
|
|
uvicorn[standard]>=0.30,<1.0
|
|
sqlalchemy>=2.0,<2.1
|
|
psycopg[binary]>=3.2,<4.0
|
|
alembic>=1.13,<2.0
|
|
pydantic>=2.7,<3.0
|
|
pydantic-settings>=2.3,<3.0
|
|
authlib>=1.3,<2.0
|
|
httpx>=0.27,<1.0
|
|
feedparser>=6.0,<7.0
|
|
apscheduler>=3.10,<4.0
|
|
py3langid>=0.3,<1.0
|
|
itsdangerous>=2.1,<3.0
|
|
cryptography>=50.0.0,<51
|
|
argon2-cffi>=23.1,<26
|
|
# Download center: yt-dlp does the extraction/download; ffmpeg (OS-level in the Dockerfile)
|
|
# does the merge + postprocessing. The [default] extra pulls yt-dlp-ejs (the challenge-solver
|
|
# scripts Deno runs for YouTube's n-signature). yt-dlp is release-often (YouTube changes), so
|
|
# keep the floor loose and bump it when extraction breaks.
|
|
yt-dlp[default]>=2025.5.22
|
|
# PO Token provider plugin: talks to the bgutil sidecar (brainicism/bgutil-ytdlp-pot-provider)
|
|
# to mint YouTube Proof-of-Origin tokens on demand, bypassing "confirm you're not a bot" and
|
|
# unlocking high-quality formats. Pin to match the sidecar image tag (versions must align).
|
|
bgutil-ytdlp-pot-provider==1.3.1
|