fix(deps): resolve all Dependabot security alerts by gkorland · Pull Request #517 · FalkorDB/QueryWeaver

gkorland · 2026-04-04T21:33:19Z

Summary

Fixes all 30 open Dependabot security alerts by bumping vulnerable dependencies to their patched versions.

Changes

Python (pyproject.toml + uv.lock)

litellm ~=1.82.0 → ~=1.83.0 — fixes 4 alerts (2 critical, 2 high)
- Authentication bypass via OIDC userinfo cache key collision
- Privilege escalation via unrestricted proxy configuration endpoint
fastmcp >=2.13.1 → >=3.2.0 — fixes 2 critical alerts
- SSRF & path traversal vulnerability in OpenAPI provider
aiohttp added >=3.13.4 constraint — fixes 20 alerts (various severities)
- Duplicate Host headers, header injection, multipart bypass, memory DoS, CRLF injection, cookie leaks, SSRF on Windows, unbounded DNS cache DoS, unlimited trailer headers
Updated fastmcp.server.openapi import to non-deprecated fastmcp.server.providers.openapi

JavaScript (package.json + package-lock.json)

lodash-es override to 4.18.1 — fixes 4 alerts (2 high, 2 medium)
- Prototype pollution via array path bypass in _.unset and _.omit
- Code injection via _.template imports key names

Testing

uv sync — dependencies resolve cleanly
make lint — pylint 10/10, ESLint passes
make build-prod — frontend builds successfully with lodash-es 4.18.1
Import verification: from fastmcp.server.providers.openapi import MCPType, RouteMap works

Memory / Performance Impact

N/A — dependency version bumps only.

Related Issues

Resolves Dependabot alerts #96–#125 (all 30 open alerts)

Summary by CodeRabbit

No user-facing changes
- This release contains internal improvements with no impact on functionality or user experience.

- Bump litellm ~=1.82.0 → ~=1.83.0 (fixes CVE: auth bypass via OIDC cache key collision, privilege escalation via unrestricted proxy config) - Bump fastmcp >=2.13.1 → >=3.2.0 (fixes CVE: SSRF & path traversal in OpenAPI provider) - Add aiohttp>=3.13.4 constraint (fixes multiple HTTP-level CVEs: duplicate Host headers, header injection, multipart bypass, memory DoS, CRLF injection, cookie leaks, SSRF on Windows) - Add npm override for lodash-es to 4.18.1 (fixes prototype pollution via array path bypass, code injection via template imports) - Update fastmcp import path from deprecated fastmcp.server.openapi to fastmcp.server.providers.openapi Closes #125, #124, #123, #122, #121, #120, #119, #118, #117, #116, #115, #114, #113, #112, #111, #110, #109, #108, #107, #106, #105, #104, #103, #102, #101, #100, #99, #98, #97, #96 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

overcut-ai · 2026-04-04T21:33:24Z

Completed Working on "Code Review"

✅ Code review complete. No issues found - all changes look good! ✅

✅ Workflow completed successfully.

👉 View complete log

coderabbitai · 2026-04-04T21:33:34Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: c2a4b079-6705-4204-beb7-6a188dcff0a3

📥 Commits

Reviewing files that changed from the base of the PR and between 8e1287d and 03bfa94.

📒 Files selected for processing (1)

api/app_factory.py

🚧 Files skipped from review as they are similar to previous changes (1)

api/app_factory.py

📝 Walkthrough

Walkthrough

The app factory now imports MCPType and RouteMap from fastmcp.server.providers.openapi. Route mappings and create_app() control flow remain unchanged.

Changes

FastMCP import update

Layer / File(s)	Summary
Update OpenAPI type imports `api/app_factory.py`	The import source for `MCPType` and `RouteMap` changed to `fastmcp.server.providers.openapi`.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the dependency security updates and related migration included in the pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/dependabot-security-alerts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

railway-app · 2026-04-04T21:33:39Z

🚅 Deployed to the QueryWeaver-pr-517 environment in queryweaver

Service	Status	Web	Updated (UTC)
QueryWeaver	🕒 Building (View Logs)	Web	Aug 12, 2026 at 8:55 pm

github-actions · 2026-04-04T21:33:49Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

galshubeli · 2026-04-05T07:04:18Z

@copilot resolve merge conflict

…onflicts - Resolved package-lock.json conflict by taking staging's version (staging already has lodash-es 4.18.1 without needing root overrides) - Removed redundant root package.json overrides for lodash-es - Retained all security fixes: litellm~=1.83.0, fastmcp>=3.2.0, aiohttp>=3.13.4 - Updated fastmcp import path (already resolved in staging) Co-authored-by: galshubeli <124919062+galshubeli@users.noreply.github.com>

Copilot · 2026-04-05T07:10:38Z

@copilot resolve merge conflict

Resolved in 0e924c1. Merged staging into this branch — the only conflict was in package-lock.json. Took staging's version since staging already has lodash-es at 4.18.1 directly (without needing root-level overrides). All security fixes are preserved: litellm~=1.83.0, fastmcp>=3.2.0, and aiohttp>=3.13.4.

gkorland · 2026-04-21T12:11:12Z

@copilot resolve the merge conflicts in this pull request

…onflicts - Resolved pyproject.toml conflict: took staging versions (fastmcp>=3.2.4, aiohttp>=3.13.5) plus new deps (snowflake-connector-python~=4.4.0, python-dotenv~=1.2.2) - Resolved uv.lock conflict: took staging's updated specifiers (authlib ~=1.7.0, fastapi ~=0.136.0, fastmcp >=3.2.4, aiohttp >=3.13.5) - All security fixes preserved Co-authored-by: gkorland <753206+gkorland@users.noreply.github.com>

Copilot · 2026-04-21T12:14:12Z

@copilot resolve the merge conflicts in this pull request

Resolved in 8e1287d. Merged the latest staging (25 new commits) into this branch. The conflicts were in pyproject.toml and uv.lock — resolved by taking staging's more up-to-date versions (fastmcp>=3.2.4, aiohttp>=3.13.5, authlib~=1.7.0, fastapi~=0.136.0) while preserving all security fixes.

railway-app Bot temporarily deployed to queryweaver / QueryWeaver-pr-517 April 4, 2026 21:33 Destroyed

gkorland requested a review from galshubeli April 5, 2026 06:00

galshubeli previously approved these changes Apr 5, 2026

View reviewed changes

Copilot started work on behalf of galshubeli April 5, 2026 07:04 View session

Copilot AI dismissed galshubeli’s stale review via 0e924c1 April 5, 2026 07:10

railway-app Bot temporarily deployed to queryweaver / QueryWeaver-pr-517 April 5, 2026 07:10 Destroyed

Copilot AI requested a review from galshubeli April 5, 2026 07:11

Copilot finished work on behalf of galshubeli April 5, 2026 07:11

galshubeli previously approved these changes Apr 5, 2026

View reviewed changes

Copilot started work on behalf of gkorland April 21, 2026 12:11 View session

Copilot AI dismissed galshubeli’s stale review via 8e1287d April 21, 2026 12:14

railway-app Bot temporarily deployed to queryweaver / QueryWeaver-pr-517 April 21, 2026 12:14 Destroyed

Copilot finished work on behalf of gkorland April 21, 2026 12:16

Merge branch 'staging' into fix/dependabot-security-alerts

d25bae2

railway-app Bot temporarily deployed to queryweaver / QueryWeaver-pr-517 May 10, 2026 11:52 Destroyed

Merge branch 'staging' into fix/dependabot-security-alerts

03bfa94

railway-app Bot temporarily deployed to queryweaver / QueryWeaver-pr-517 August 12, 2026 20:49 Destroyed

gkorland merged commit e3bbb8c into staging Aug 12, 2026
13 of 14 checks passed

gkorland deleted the fix/dependabot-security-alerts branch August 12, 2026 20:56

Navigation Menu

Uh oh!

fix(deps): resolve all Dependabot security alerts - #517

fix(deps): resolve all Dependabot security alerts#517
gkorland merged 5 commits into
stagingfrom
fix/dependabot-security-alerts

gkorland commented Apr 4, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

overcut-ai Bot commented Apr 4, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Apr 4, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

railway-app Bot commented Apr 4, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Apr 4, 2026 •

edited

Loading

Uh oh!

galshubeli commented Apr 5, 2026

Uh oh!

Copilot AI commented Apr 5, 2026

Uh oh!

gkorland commented Apr 21, 2026

Uh oh!

Copilot AI commented Apr 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

gkorland commented Apr 4, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Python (pyproject.toml + uv.lock)

JavaScript (package.json + package-lock.json)

Testing

Memory / Performance Impact

Related Issues

Summary by CodeRabbit

Uh oh!

overcut-ai Bot commented Apr 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Completed Working on "Code Review"

Uh oh!

coderabbitai Bot commented Apr 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

railway-app Bot commented Apr 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Apr 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

Scanned Files

Uh oh!

galshubeli commented Apr 5, 2026

Uh oh!

Copilot AI commented Apr 5, 2026

Uh oh!

gkorland commented Apr 21, 2026

Uh oh!

Copilot AI commented Apr 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

gkorland commented Apr 4, 2026 •

edited by coderabbitai Bot

Loading

overcut-ai Bot commented Apr 4, 2026 •

edited

Loading

coderabbitai Bot commented Apr 4, 2026 •

edited

Loading

railway-app Bot commented Apr 4, 2026 •

edited

Loading

github-actions Bot commented Apr 4, 2026 •

edited

Loading