From d3933a4364453ef42e3e29f8d8902688a53524d8 Mon Sep 17 00:00:00 2001 From: Eyal Danieli Date: Sun, 16 Aug 2026 13:27:13 +0300 Subject: [PATCH 1/2] bump pytest, requests, and scikit-learn to patch moderate vulnerabilities (#985) --- functions/src/describe/requirements.txt | 2 +- functions/src/sklearn_classifier/requirements.txt | 2 +- modules/src/agent_deployer/requirements.txt | 2 +- modules/src/count_events/requirements.txt | 2 +- modules/src/openai_proxy_app/item.yaml | 2 +- modules/src/openai_proxy_app/requirements.txt | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/functions/src/describe/requirements.txt b/functions/src/describe/requirements.txt index ac445e6d6..1cdd659dd 100644 --- a/functions/src/describe/requirements.txt +++ b/functions/src/describe/requirements.txt @@ -1,5 +1,5 @@ scikit-learn~=1.5.2 plotly~=5.23 -pytest~=7.0.1 +pytest~=9.0.3 matplotlib~=3.5.1 seaborn~=0.11.2 diff --git a/functions/src/sklearn_classifier/requirements.txt b/functions/src/sklearn_classifier/requirements.txt index 4d9e097f9..c99801cfd 100644 --- a/functions/src/sklearn_classifier/requirements.txt +++ b/functions/src/sklearn_classifier/requirements.txt @@ -1,5 +1,5 @@ pandas -scikit-learn==1.0.2 +scikit-learn==1.5.2 matplotlib seaborn scikit-plot diff --git a/modules/src/agent_deployer/requirements.txt b/modules/src/agent_deployer/requirements.txt index 8cc866bd2..b51f1a0e7 100644 --- a/modules/src/agent_deployer/requirements.txt +++ b/modules/src/agent_deployer/requirements.txt @@ -1,2 +1,2 @@ mlrun==1.10.0 -pytest~=8.2 \ No newline at end of file +pytest~=9.0.3 \ No newline at end of file diff --git a/modules/src/count_events/requirements.txt b/modules/src/count_events/requirements.txt index 0c107c276..8c53204bd 100644 --- a/modules/src/count_events/requirements.txt +++ b/modules/src/count_events/requirements.txt @@ -1,3 +1,3 @@ mlrun==1.10.0-rc41 pandas==2.1.4 -pytest~=8.2 \ No newline at end of file +pytest~=9.0.3 \ No newline at end of file diff --git a/modules/src/openai_proxy_app/item.yaml b/modules/src/openai_proxy_app/item.yaml index 4a81043cb..c35d4acde 100644 --- a/modules/src/openai_proxy_app/item.yaml +++ b/modules/src/openai_proxy_app/item.yaml @@ -16,6 +16,6 @@ spec: - fastapi==0.124.0 - uvicorn[standard]==0.38.0 - gunicorn==23.0.0 - - requests==2.32.5 + - requests==2.33.0 kind: generic version: 1.0.0 diff --git a/modules/src/openai_proxy_app/requirements.txt b/modules/src/openai_proxy_app/requirements.txt index cae87cd9e..598e67683 100644 --- a/modules/src/openai_proxy_app/requirements.txt +++ b/modules/src/openai_proxy_app/requirements.txt @@ -1,4 +1,4 @@ fastapi==0.124.0 uvicorn[standard]==0.38.0 gunicorn==23.0.0 -requests==2.32.5 +requests==2.33.0 From d00f622701649c0645e5e0d39144db81d65793eb Mon Sep 17 00:00:00 2001 From: Eyal Danieli Date: Sun, 16 Aug 2026 15:36:01 +0300 Subject: [PATCH 2/2] Security: enable Jinja2 autoescaping in CLI template rendering (FHUB-259) --- cli/common/generate_item_yaml.py | 4 ++-- cli/utils/helpers.py | 7 +++++-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/cli/common/generate_item_yaml.py b/cli/common/generate_item_yaml.py index e97089ad3..2de4deb2b 100644 --- a/cli/common/generate_item_yaml.py +++ b/cli/common/generate_item_yaml.py @@ -2,7 +2,7 @@ from pathlib import Path from datetime import datetime, timezone import click -from jinja2 import Environment, FileSystemLoader +from jinja2 import Environment, FileSystemLoader, select_autoescape TEMPLATES = { "function": "cli/utils/function_item_template.yaml.j2", @@ -44,7 +44,7 @@ def generate_item_yaml(type: str, name: str, overwrite: bool = False): } # Load and render template - env = Environment(loader=FileSystemLoader(".")) + env = Environment(loader=FileSystemLoader("."), autoescape=select_autoescape()) template = env.get_template(TEMPLATES[type]) rendered = template.render(params) diff --git a/cli/utils/helpers.py b/cli/utils/helpers.py index fabccbf7a..14eb53945 100644 --- a/cli/utils/helpers.py +++ b/cli/utils/helpers.py @@ -20,7 +20,7 @@ import sys from glob import iglob import yaml -from jinja2 import Template +from jinja2 import Template, select_autoescape PROJECT_ROOT = Path(__file__).parent.parent.parent.absolute() @@ -44,7 +44,10 @@ def render_jinja( with open(template_path, "r") as t: template_text = t.read() - template = Template(template_text) + autoescape = select_autoescape(enabled_extensions=("html", "htm", "xml"))( + str(template_path) + ) + template = Template(template_text, autoescape=autoescape) rendered = template.render(**data) with open(output_path, "w+") as out_t: