From ce5aa4c8a76809be86040f6252a557e89a6c446c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?dni=20=E2=9A=A1?= Date: Mon, 23 Mar 2026 10:35:30 +0100 Subject: [PATCH] chore: fix security audit from `uv audit` (#3884) --- poetry.lock | 62 +++++++++++++++++++------------------------------- pyproject.toml | 8 +++---- uv.lock | 43 ++++++++++++++-------------------- 3 files changed, 44 insertions(+), 69 deletions(-) diff --git a/poetry.lock b/poetry.lock index 2ff1ff53d..0764ff3ec 100644 --- a/poetry.lock +++ b/poetry.lock @@ -450,14 +450,14 @@ files = [ [[package]] name = "bip32" -version = "4.0" -description = "Minimalistic implementation of the BIP32 key derivation scheme" +version = "5.0.0" +description = "Minimalistic implementation of BIP32 (Bitcoin HD wallets)" optional = false -python-versions = "*" +python-versions = ">=3.9" groups = ["main"] files = [ - {file = "bip32-4.0-py3-none-any.whl", hash = "sha256:9728b38336129c00e1f870bbb3e328c9632d51c1bddeef4011fd3115cb3aeff9"}, - {file = "bip32-4.0.tar.gz", hash = "sha256:8035588f252f569bb414bc60df151ae431fc1c6789a19488a32890532ef3a2fc"}, + {file = "bip32-5.0.0-py3-none-any.whl", hash = "sha256:b20872795ae2bb4e5fac351f53ccdf2b998f82e927413922a2c5473a004bd6d0"}, + {file = "bip32-5.0.0.tar.gz", hash = "sha256:4caa1f74eed9f2cd4624b55f34a4094f52542552fe3d0cc52e1179b8d6e9f21e"}, ] [package.dependencies] @@ -1360,25 +1360,6 @@ idna = ["idna (>=3.10)"] trio = ["trio (>=0.30)"] wmi = ["wmi (>=1.5.1) ; platform_system == \"Windows\""] -[[package]] -name = "ecdsa" -version = "0.19.1" -description = "ECDSA cryptographic signature library (pure python)" -optional = false -python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,!=3.5.*,>=2.6" -groups = ["main"] -files = [ - {file = "ecdsa-0.19.1-py2.py3-none-any.whl", hash = "sha256:30638e27cf77b7e15c4c4cc1973720149e1033827cfd00661ca5c8cc0cdb24c3"}, - {file = "ecdsa-0.19.1.tar.gz", hash = "sha256:478cba7b62555866fcb3bb3fe985e06decbdb68ef55713c4e5ab98c57d508e61"}, -] - -[package.dependencies] -six = ">=1.9.0" - -[package.extras] -gmpy = ["gmpy"] -gmpy2 = ["gmpy2"] - [[package]] name = "email-validator" version = "2.3.0" @@ -2278,24 +2259,24 @@ valkey = ["valkey (>=6)"] [[package]] name = "lnurl" -version = "0.8.3" +version = "0.10.0" description = "LNURL implementation for Python." optional = false -python-versions = ">=3.10" +python-versions = "<3.13,>=3.10" groups = ["main"] files = [ - {file = "lnurl-0.8.3-py3-none-any.whl", hash = "sha256:670cdeaef2c55de986dad89126ab58275d5199ba6554a93d9965d1e162080c2a"}, - {file = "lnurl-0.8.3.tar.gz", hash = "sha256:8ca73af84fb9ee36a184d731d165f289ba7bc6260d4dadb2b6cf24f381c3afba"}, + {file = "lnurl-0.10.0-py3-none-any.whl", hash = "sha256:0d43561b4370cecec19c8f1044fc840f0199fc2698bc83cd8782e8264bfde8f4"}, + {file = "lnurl-0.10.0.tar.gz", hash = "sha256:55ba0a7e810bcdfc7410c682f91c76df4446ff24e83d6bf931a7c759e2e0d5cc"}, ] [package.dependencies] bech32 = "*" -bip32 = ">=4.0,<5.0" +bip32 = ">=5.0.0" bolt11 = "*" -ecdsa = "*" +coincurve = ">=20.0.0" httpx = "*" -pycryptodomex = ">=3.21.0,<4.0.0" -pydantic = ">=1,<2" +pycryptodomex = ">=3.21.0" +pydantic = ">=1.10.0,<2.0.0" [[package]] name = "loguru" @@ -3409,21 +3390,24 @@ windows-terminal = ["colorama (>=0.4.6)"] [[package]] name = "pyjwt" -version = "2.10.1" +version = "2.12.1" description = "JSON Web Token implementation in Python" optional = false python-versions = ">=3.9" groups = ["main"] files = [ - {file = "PyJWT-2.10.1-py3-none-any.whl", hash = "sha256:dcdd193e30abefd5debf142f9adfcdd2b58004e644f25406ffaebd50bd98dacb"}, - {file = "pyjwt-2.10.1.tar.gz", hash = "sha256:3cc5772eb20009233caf06e9d8a0577824723b44e6648ee0a2aedb6cf9381953"}, + {file = "pyjwt-2.12.1-py3-none-any.whl", hash = "sha256:28ca37c070cad8ba8cd9790cd940535d40274d22f80ab87f3ac6a713e6e8454c"}, + {file = "pyjwt-2.12.1.tar.gz", hash = "sha256:c74a7a2adf861c04d002db713dd85f84beb242228e671280bf709d765b03672b"}, ] +[package.dependencies] +typing_extensions = {version = ">=4.0", markers = "python_version < \"3.11\""} + [package.extras] crypto = ["cryptography (>=3.4.0)"] -dev = ["coverage[toml] (==5.0.4)", "cryptography (>=3.4.0)", "pre-commit", "pytest (>=6.0.0,<7.0.0)", "sphinx", "sphinx-rtd-theme", "zope.interface"] +dev = ["coverage[toml] (==7.10.7)", "cryptography (>=3.4.0)", "pre-commit", "pytest (>=8.4.2,<9.0.0)", "sphinx", "sphinx-rtd-theme", "zope.interface"] docs = ["sphinx", "sphinx-rtd-theme", "zope.interface"] -tests = ["coverage[toml] (==5.0.4)", "pytest (>=6.0.0,<7.0.0)"] +tests = ["coverage[toml] (==7.10.7)", "pytest (>=8.4.2,<9.0.0)"] [[package]] name = "pyln-bolt7" @@ -4117,7 +4101,7 @@ version = "1.17.0" description = "Python 2 and 3 compatibility utilities" optional = false python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,>=2.7" -groups = ["main", "dev"] +groups = ["dev"] files = [ {file = "six-1.17.0-py2.py3-none-any.whl", hash = "sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274"}, {file = "six-1.17.0.tar.gz", hash = "sha256:ff70335d468e7eb6ec65b95b99d3a2836546063f63acc5171de367e834932a81"}, @@ -5044,4 +5028,4 @@ migration = ["psycopg2-binary"] [metadata] lock-version = "2.1" python-versions = ">=3.10,<3.13" -content-hash = "0a17b39d328781b8411a2f009d1ad5629ffeae680612fc14b471f1c8d572193d" +content-hash = "42751c05e1fa8250ff90981def5e0ce8d1b284eeb2acc2c7ac9ae5847cf99e17" diff --git a/pyproject.toml b/pyproject.toml index 0aa6d5186..326d1cf23 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -13,7 +13,7 @@ dependencies = [ "starlette~=0.47.1", "httpx~=0.27.2", "jinja2~=3.1.6", - "lnurl~=0.8.3", + "lnurl~=0.10.0", "pydantic~=1.10.26", "pyqrcode~=1.2.1", "shortuuid~=1.0.13", @@ -27,7 +27,7 @@ dependencies = [ "websockets~=15.0.1", "loguru~=0.7.3", "grpcio~=1.76.0", - "protobuf~=6.33.2", + "protobuf~=6.33.5", "pyln-client~=25.12.0", "pywebpush~=2.2.0", "slowapi~=0.1.9", @@ -35,7 +35,7 @@ dependencies = [ "pycryptodomex~=3.23.0", "packaging~=25.0.0", "bolt11~=2.1.1", - "pyjwt~=2.10.1", + "pyjwt~=2.12.0", "itsdangerous~=2.2.0", "fastapi-sso~=0.19.0", # needed for boltz, lnurldevice, watchonly extensions @@ -43,7 +43,7 @@ dependencies = [ # needed for scheduler extension "python-crontab~=3.3.0", "pynostr~=0.7.0", - "python-multipart~=0.0.21", + "python-multipart~=0.0.22", "filetype~=1.2.0", "nostr-sdk~=0.44.0", "bcrypt~=5.0.0", diff --git a/uv.lock b/uv.lock index 9730965a7..a0dd06fce 100644 --- a/uv.lock +++ b/uv.lock @@ -261,14 +261,14 @@ wheels = [ [[package]] name = "bip32" -version = "4.0" +version = "5.0.0" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "coincurve" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/4a/37/b69968b1b6eaea1fedb8efdb1862d86e92b6f68e182f39c764f894984db5/bip32-4.0.tar.gz", hash = "sha256:8035588f252f569bb414bc60df151ae431fc1c6789a19488a32890532ef3a2fc", size = 21662, upload-time = "2024-09-07T12:40:26.388Z" } +sdist = { url = "https://files.pythonhosted.org/packages/b3/ad/857ffe66a4bbe8f8f2e9c0e792e19944d7cd0909546e2ac47249857f82c3/bip32-5.0.0.tar.gz", hash = "sha256:4caa1f74eed9f2cd4624b55f34a4094f52542552fe3d0cc52e1179b8d6e9f21e", size = 21668, upload-time = "2025-11-13T18:36:25.181Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/00/bd/dcf1650776a241c10a2bc6826b6e23ff63bf55373bb053b716c69c463758/bip32-4.0-py3-none-any.whl", hash = "sha256:9728b38336129c00e1f870bbb3e328c9632d51c1bddeef4011fd3115cb3aeff9", size = 12898, upload-time = "2024-09-07T12:40:25.358Z" }, + { url = "https://files.pythonhosted.org/packages/d8/b7/f971ff16f791a65a19f75ca0fe341d1ed7e56c99deae1bc7652c687dfa38/bip32-5.0.0-py3-none-any.whl", hash = "sha256:b20872795ae2bb4e5fac351f53ccdf2b998f82e927413922a2c5473a004bd6d0", size = 13007, upload-time = "2025-11-13T18:36:23.62Z" }, ] [[package]] @@ -754,18 +754,6 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/ba/5a/18ad964b0086c6e62e2e7500f7edc89e3faa45033c71c1893d34eed2b2de/dnspython-2.8.0-py3-none-any.whl", hash = "sha256:01d9bbc4a2d76bf0db7c1f729812ded6d912bd318d3b1cf81d30c0f845dbf3af", size = 331094, upload-time = "2025-09-07T18:57:58.071Z" }, ] -[[package]] -name = "ecdsa" -version = "0.19.1" -source = { registry = "https://pypi.org/simple" } -dependencies = [ - { name = "six" }, -] -sdist = { url = "https://files.pythonhosted.org/packages/c0/1f/924e3caae75f471eae4b26bd13b698f6af2c44279f67af317439c2f4c46a/ecdsa-0.19.1.tar.gz", hash = "sha256:478cba7b62555866fcb3bb3fe985e06decbdb68ef55713c4e5ab98c57d508e61", size = 201793, upload-time = "2025-03-13T11:52:43.25Z" } -wheels = [ - { url = "https://files.pythonhosted.org/packages/cb/a3/460c57f094a4a165c84a1341c373b0a4f5ec6ac244b998d5021aade89b77/ecdsa-0.19.1-py2.py3-none-any.whl", hash = "sha256:30638e27cf77b7e15c4c4cc1973720149e1033827cfd00661ca5c8cc0cdb24c3", size = 150607, upload-time = "2025-03-13T11:52:41.757Z" }, -] - [[package]] name = "email-validator" version = "2.3.0" @@ -1377,22 +1365,22 @@ requires-dist = [ { name = "itsdangerous", specifier = "~=2.2.0" }, { name = "jinja2", specifier = "~=3.1.6" }, { name = "jsonpath-ng", specifier = "~=1.7.0" }, - { name = "lnurl", specifier = "~=0.8.3" }, + { name = "lnurl", specifier = "~=0.10.0" }, { name = "loguru", specifier = "~=0.7.3" }, { name = "nostr-sdk", specifier = "~=0.44.0" }, { name = "packaging", specifier = "~=25.0.0" }, { name = "pillow", specifier = "~=12.1.0" }, - { name = "protobuf", specifier = "~=6.33.2" }, + { name = "protobuf", specifier = "~=6.33.5" }, { name = "psycopg2-binary", marker = "extra == 'migration'", specifier = "~=2.9.11" }, { name = "pycryptodomex", specifier = "~=3.23.0" }, { name = "pydantic", specifier = "~=1.10.26" }, - { name = "pyjwt", specifier = "~=2.10.1" }, + { name = "pyjwt", specifier = "~=2.12.0" }, { name = "pyln-client", specifier = "~=25.12.0" }, { name = "pynostr", specifier = "~=0.7.0" }, { name = "pyqrcode", specifier = "~=1.2.1" }, { name = "python-crontab", specifier = "~=3.3.0" }, { name = "python-dotenv", specifier = "~=1.2.1" }, - { name = "python-multipart", specifier = "~=0.0.21" }, + { name = "python-multipart", specifier = "~=0.0.22" }, { name = "pywebpush", specifier = "~=2.2.0" }, { name = "shortuuid", specifier = "~=1.0.13" }, { name = "slowapi", specifier = "~=0.1.9" }, @@ -1433,20 +1421,20 @@ dev = [ [[package]] name = "lnurl" -version = "0.8.3" +version = "0.10.0" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "bech32" }, { name = "bip32" }, { name = "bolt11" }, - { name = "ecdsa" }, + { name = "coincurve" }, { name = "httpx" }, { name = "pycryptodomex" }, { name = "pydantic" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/9b/dc/29cce6bb8688622c7f5f6db4355c54b5c87bb05be58e49374fd2c6f4b0f2/lnurl-0.8.3.tar.gz", hash = "sha256:8ca73af84fb9ee36a184d731d165f289ba7bc6260d4dadb2b6cf24f381c3afba", size = 17171, upload-time = "2025-09-08T13:30:56.636Z" } +sdist = { url = "https://files.pythonhosted.org/packages/25/cc/e4849752e88c6d346de52eb14f4bd2860e8276dcbc657536211d38e0a2e0/lnurl-0.10.0.tar.gz", hash = "sha256:55ba0a7e810bcdfc7410c682f91c76df4446ff24e83d6bf931a7c759e2e0d5cc", size = 67646, upload-time = "2026-03-20T12:42:10.879Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/fd/99/e400734afb7469a0cfa661259de2bb66417d6c3f14361444a010e9d186ee/lnurl-0.8.3-py3-none-any.whl", hash = "sha256:670cdeaef2c55de986dad89126ab58275d5199ba6554a93d9965d1e162080c2a", size = 17459, upload-time = "2025-09-08T13:30:55.691Z" }, + { url = "https://files.pythonhosted.org/packages/99/88/b8abeed9844a71ad91c10b3046d79afc8de1da1b8e74002090b54c1e1d7d/lnurl-0.10.0-py3-none-any.whl", hash = "sha256:0d43561b4370cecec19c8f1044fc840f0199fc2698bc83cd8782e8264bfde8f4", size = 17375, upload-time = "2026-03-20T12:42:09.872Z" }, ] [[package]] @@ -2043,11 +2031,14 @@ wheels = [ [[package]] name = "pyjwt" -version = "2.10.1" +version = "2.12.1" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/e7/46/bd74733ff231675599650d3e47f361794b22ef3e3770998dda30d3b63726/pyjwt-2.10.1.tar.gz", hash = "sha256:3cc5772eb20009233caf06e9d8a0577824723b44e6648ee0a2aedb6cf9381953", size = 87785, upload-time = "2024-11-28T03:43:29.933Z" } +dependencies = [ + { name = "typing-extensions", marker = "python_full_version < '3.11'" }, +] +sdist = { url = "https://files.pythonhosted.org/packages/c2/27/a3b6e5bf6ff856d2509292e95c8f57f0df7017cf5394921fc4e4ef40308a/pyjwt-2.12.1.tar.gz", hash = "sha256:c74a7a2adf861c04d002db713dd85f84beb242228e671280bf709d765b03672b", size = 102564, upload-time = "2026-03-13T19:27:37.25Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/61/ad/689f02752eeec26aed679477e80e632ef1b682313be70793d798c1d5fc8f/PyJWT-2.10.1-py3-none-any.whl", hash = "sha256:dcdd193e30abefd5debf142f9adfcdd2b58004e644f25406ffaebd50bd98dacb", size = 22997, upload-time = "2024-11-28T03:43:27.893Z" }, + { url = "https://files.pythonhosted.org/packages/e5/7a/8dd906bd22e79e47397a61742927f6747fe93242ef86645ee9092e610244/pyjwt-2.12.1-py3-none-any.whl", hash = "sha256:28ca37c070cad8ba8cd9790cd940535d40274d22f80ab87f3ac6a713e6e8454c", size = 29726, upload-time = "2026-03-13T19:27:35.677Z" }, ] [[package]]