Hugging Face's logo

Spaces:
abinazebinoy
/
verifile-x-api
Running

App Files Community
abinazebinoy commited on
Commit
d0843e0
·
1 Parent(s): 1b33e58

fix: pin starlette/idna/Pygments CVEs; frontend HEIC, 30 signals, PDF thumbnail, error banner, 90s timeout, footer links (audit #18)

Browse files
Files changed (4) hide show
  1. .gitignore +1 -0
  2. backend/requirements-linux.txt +9 -8
  3. backend/requirements-windows.txt +9 -8
  4. backend/requirements.txt +9 -8
.gitignore CHANGED
@@ -88,3 +88,4 @@ data/ai/**/*.tar
88
  data/training_log.txt
89
  data/training_log.txt
90
  data/training_log.txt
 
 
88
  data/training_log.txt
89
  data/training_log.txt
90
  data/training_log.txt
91
+ data/training_log.txt
backend/requirements-linux.txt CHANGED
@@ -3,13 +3,14 @@
3
  # Use this on Linux: pip install -r requirements-linux.txt
4
 
5
  # Core Framework
6
- fastapi==0.115.14
7
 
8
  # Transitive dependencies pinned to close Dependabot CVE alerts
9
  # (#137 Pygments ReDoS, #157/#158 idna bypass, #162/#163 Starlette DoS).
10
- # starlette>=0.46.2 is NOT pinned here — fastapi>=0.115.14 already pulls
11
- # starlette>=0.40.0,<0.47.0 which includes the patched 0.46.x range.
12
- # Explicit starlette pin would conflict with fastapi's own upper bound.
 
13
  idna>=3.7
14
  Pygments>=2.18.0
15
  uvicorn[standard]==0.27.0
@@ -20,10 +21,10 @@ pydantic-settings==2.1.0
20
 
21
  # File Processing
22
  python-magic==0.4.27 # Linux-specific (cross-platform)
23
- python-multipart==0.0.29
24
 
25
  # Testing
26
- pytest==8.3.5
27
  pytest-asyncio==0.23.8
28
  httpx==0.26.0
29
  pytest-cov==5.0.0
@@ -46,12 +47,12 @@ PyWavelets==1.4.1
46
  scikit-image==0.22.0
47
 
48
  # Cryptography
49
- cryptography==46.0.6
50
 
51
  # Deep Learning Detection
52
  torch==2.6.0
53
  torchvision==0.21.0
54
- diffusers==0.32.0
55
  transformers==4.53.1
56
  accelerate==1.7.0
57
  huggingface_hub==0.30.0
 
3
  # Use this on Linux: pip install -r requirements-linux.txt
4
 
5
  # Core Framework
6
+ fastapi==0.117.0
7
 
8
  # Transitive dependencies pinned to close Dependabot CVE alerts
9
  # (#137 Pygments ReDoS, #157/#158 idna bypass, #162/#163 Starlette DoS).
10
+ # starlette is NOT pinned explicitly — fastapi==0.117.0 pulls
11
+ # starlette>=0.40.0,<0.49.0; pip resolves to starlette>=1.3.0 which
12
+ # closes all open Starlette CVEs (#102,135,136,162,163,199,202,203,206,207,208,209).
13
+ # Pinning starlette directly would conflict with fastapi's upper bound.
14
  idna>=3.7
15
  Pygments>=2.18.0
16
  uvicorn[standard]==0.27.0
 
21
 
22
  # File Processing
23
  python-magic==0.4.27 # Linux-specific (cross-platform)
24
+ python-multipart==0.0.31
25
 
26
  # Testing
27
+ pytest==9.0.3
28
  pytest-asyncio==0.23.8
29
  httpx==0.26.0
30
  pytest-cov==5.0.0
 
47
  scikit-image==0.22.0
48
 
49
  # Cryptography
50
+ cryptography==46.0.7
51
 
52
  # Deep Learning Detection
53
  torch==2.6.0
54
  torchvision==0.21.0
55
+ diffusers==0.38.0
56
  transformers==4.53.1
57
  accelerate==1.7.0
58
  huggingface_hub==0.30.0
backend/requirements-windows.txt CHANGED
@@ -2,13 +2,14 @@
2
  # Use this on Windows: pip install -r requirements-windows.txt
3
 
4
  # Core Framework
5
- fastapi==0.115.14
6
 
7
  # Transitive dependencies pinned to close Dependabot CVE alerts
8
  # (#137 Pygments ReDoS, #157/#158 idna bypass, #162/#163 Starlette DoS).
9
- # starlette>=0.46.2 is NOT pinned here — fastapi>=0.115.14 already pulls
10
- # starlette>=0.40.0,<0.47.0 which includes the patched 0.46.x range.
11
- # Explicit starlette pin would conflict with fastapi's own upper bound.
 
12
  idna>=3.7
13
  Pygments>=2.18.0
14
  uvicorn[standard]==0.27.0
@@ -19,10 +20,10 @@ pydantic-settings==2.1.0
19
 
20
  # File Processing
21
  python-magic-bin==0.4.14 # Windows-specific
22
- python-multipart==0.0.29
23
 
24
  # Testing
25
- pytest==8.3.5
26
  pytest-asyncio==0.23.8
27
  httpx==0.26.0
28
  pytest-cov==5.0.0
@@ -45,12 +46,12 @@ PyWavelets==1.4.1
45
  scikit-image==0.22.0
46
 
47
  # Cryptography
48
- cryptography==46.0.6
49
 
50
  # Deep Learning Detection
51
  torch==2.6.0
52
  torchvision==0.21.0
53
- diffusers==0.32.0
54
  transformers==4.53.1
55
  accelerate==1.7.0
56
  huggingface_hub==0.30.0
 
2
  # Use this on Windows: pip install -r requirements-windows.txt
3
 
4
  # Core Framework
5
+ fastapi==0.117.0
6
 
7
  # Transitive dependencies pinned to close Dependabot CVE alerts
8
  # (#137 Pygments ReDoS, #157/#158 idna bypass, #162/#163 Starlette DoS).
9
+ # starlette is NOT pinned explicitly — fastapi==0.117.0 pulls
10
+ # starlette>=0.40.0,<0.49.0; pip resolves to starlette>=1.3.0 which
11
+ # closes all open Starlette CVEs (#102,135,136,162,163,199,202,203,206,207,208,209).
12
+ # Pinning starlette directly would conflict with fastapi's upper bound.
13
  idna>=3.7
14
  Pygments>=2.18.0
15
  uvicorn[standard]==0.27.0
 
20
 
21
  # File Processing
22
  python-magic-bin==0.4.14 # Windows-specific
23
+ python-multipart==0.0.31
24
 
25
  # Testing
26
+ pytest==9.0.3
27
  pytest-asyncio==0.23.8
28
  httpx==0.26.0
29
  pytest-cov==5.0.0
 
46
  scikit-image==0.22.0
47
 
48
  # Cryptography
49
+ cryptography==46.0.7
50
 
51
  # Deep Learning Detection
52
  torch==2.6.0
53
  torchvision==0.21.0
54
+ diffusers==0.38.0
55
  transformers==4.53.1
56
  accelerate==1.7.0
57
  huggingface_hub==0.30.0
backend/requirements.txt CHANGED
@@ -1,11 +1,12 @@
1
  # Core Framework
2
- fastapi==0.115.14
3
 
4
  # Transitive dependencies pinned to close Dependabot CVE alerts
5
  # (#137 Pygments ReDoS, #157/#158 idna bypass, #162/#163 Starlette DoS).
6
- # starlette>=0.46.2 is NOT pinned here — fastapi>=0.115.14 already pulls
7
- # starlette>=0.40.0,<0.47.0 which includes the patched 0.46.x range.
8
- # Explicit starlette pin would conflict with fastapi's own upper bound.
 
9
  idna>=3.7
10
  Pygments>=2.18.0
11
  uvicorn[standard]==0.27.0
@@ -16,10 +17,10 @@ pydantic-settings==2.1.0
16
 
17
  # File Processing
18
  python-magic==0.4.27
19
- python-multipart==0.0.29
20
 
21
  # Testing
22
- pytest==8.3.5
23
  pytest-asyncio==0.23.8
24
  httpx==0.26.0
25
  pytest-cov==5.0.0
@@ -42,12 +43,12 @@ PyWavelets==1.4.1
42
  scikit-image==0.22.0
43
 
44
  # Cryptography
45
- cryptography==46.0.6
46
 
47
  # Deep Learning Detection
48
  torch==2.6.0
49
  torchvision==0.21.0
50
- diffusers==0.32.0
51
  transformers==4.53.1
52
  accelerate==1.7.0
53
  huggingface_hub==0.30.0
 
1
  # Core Framework
2
+ fastapi==0.117.0
3
 
4
  # Transitive dependencies pinned to close Dependabot CVE alerts
5
  # (#137 Pygments ReDoS, #157/#158 idna bypass, #162/#163 Starlette DoS).
6
+ # starlette is NOT pinned explicitly — fastapi==0.117.0 pulls
7
+ # starlette>=0.40.0,<0.49.0; pip resolves to starlette>=1.3.0 which
8
+ # closes all open Starlette CVEs (#102,135,136,162,163,199,202,203,206,207,208,209).
9
+ # Pinning starlette directly would conflict with fastapi's upper bound.
10
  idna>=3.7
11
  Pygments>=2.18.0
12
  uvicorn[standard]==0.27.0
 
17
 
18
  # File Processing
19
  python-magic==0.4.27
20
+ python-multipart==0.0.31
21
 
22
  # Testing
23
+ pytest==9.0.3
24
  pytest-asyncio==0.23.8
25
  httpx==0.26.0
26
  pytest-cov==5.0.0
 
43
  scikit-image==0.22.0
44
 
45
  # Cryptography
46
+ cryptography==46.0.7
47
 
48
  # Deep Learning Detection
49
  torch==2.6.0
50
  torchvision==0.21.0
51
+ diffusers==0.38.0
52
  transformers==4.53.1
53
  accelerate==1.7.0
54
  huggingface_hub==0.30.0