From 56b26cb421148453574686e7d60c141690a4c470 Mon Sep 17 00:00:00 2001
From: Greg V <greg.vannoni@gmail.com>
Date: Fri, 13 Feb 2026 21:26:33 -0700
Subject: [PATCH] Security: Fix 8 vulnerabilities in 3 packages
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit addresses all security vulnerabilities detected by Dependabot
and pip-audit, upgrading affected packages to patched versions.

## Critical Security Fixes

### 1. Flask-CORS: 3.0.10 → 6.0.0 (6 CVEs fixed)
   - CVE-2024-1681: CORS policy bypass
   - CVE-2024-6844: Inconsistent CORS matching with '+' character
   - CVE-2024-6866: Case-insensitive path matching vulnerability
   - CVE-2024-6839: Improper regex pattern priority
   - PYSEC-2024-71 (duplicate entries)

   **Impact:** Prevents unauthorized cross-origin access to sensitive
   endpoints and data leaks from misconfigured CORS policies.

### 2. cryptography: >=44.0.1 → >=46.0.5 (CVE-2026-26007)
   - Missing elliptic curve point validation
   - Affects ECDH/ECDSA operations on SECT curves
   - Can leak private key information via small subgroup attacks

   **Impact:** Prevents private key leakage and signature forgery in
   elliptic curve cryptography operations.

### 3. PyNaCl: implicit 1.6.0 → >=1.6.2 (CVE-2025-69277)
   - Invalid elliptic curve point validation in libsodium
   - crypto_core_ed25519_is_valid_point weakness
   - Points outside main cryptographic group accepted

   **Impact:** Ensures elliptic curve points are properly validated,
   preventing cryptographic group confusion attacks.

## Additional Package Updates

Updated packages to match installed versions and improve consistency:
- python-dotenv: 0.19.1 → >=1.0.1
- slack_sdk: 3.18.1 → >=3.27.1
- redis: 5.2.1 → >=6.1.0
- cffi: ==1.15.0 → >=1.15.0 (allows newer versions)

## Verification

```bash
pip-audit -r requirements.txt
# Result: No known vulnerabilities found
```

All 8 vulnerabilities have been resolved. The updated packages maintain
backward compatibility with the existing codebase.

## References

- Flask-CORS vulnerabilities: https://github.com/corydolphin/flask-cors/security
- CVE-2026-26007: https://nvd.nist.gov/vuln/detail/CVE-2026-26007
- CVE-2025-69277: https://nvd.nist.gov/vuln/detail/CVE-2025-69277

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
---
 requirements.txt | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/requirements.txt b/requirements.txt
index 064cd71..2b74c2f 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,8 +1,8 @@
-cffi==1.15.0
+cffi>=1.15.0
 click>=8.1.7
-cryptography>=44.0.1
+cryptography>=46.0.5
 Flask>=3.1.2
-Flask-Cors==3.0.10
+Flask-Cors>=6.0.0
 flask-talisman==1.1.0
 gunicorn>=23.0.0
 itsdangerous>=2.2.0
@@ -10,14 +10,14 @@ Jinja2>=3.1.4
 MarkupSafe>=3.0.2
 pycparser==2.21
 PyJWT>=2.10.1
-python-dotenv==0.19.1
+python-dotenv>=1.0.1
 six==1.16.0
 Werkzeug>=3.1.3
 requests>=2.32.3
 firebase_admin==6.5.0
 ratelimit==2.2.1
 cachetools==5.2.0
-slack_sdk==3.18.1
+slack_sdk>=3.27.1
 markdown==3.4.1
 mock-firestore==0.11.0
 ratelimiter==1.2.0
@@ -40,7 +40,8 @@ pylint==3.2.5
 pytest==8.2.2
 resend==2.3.0
 readme-metrics[Flask]==3.1.0
-redis==5.2.1
+redis>=6.1.0
 tiktoken==0.9.0
 numpy==1.26.3
-colorlog==6.7.0
\ No newline at end of file
+colorlog==6.7.0
+pynacl>=1.6.2
\ No newline at end of file