Skip to content

v2.2.1 - Security Update

Choose a tag to compare

View all tags
@bjeans bjeans released this 08 Jan 05:35
· 32 commits to main since this release
v2.2.1
b2cad8d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security Update

This release addresses 9 dependency vulnerabilities by updating aiohttp from 3.13.2 to 3.13.3.

CVEs Addressed

CVE Severity Description
CVE-2025-69223 HIGH Improper Handling of Highly Compressed Data
CVE-2025-69227 MEDIUM Infinite Loop
CVE-2025-69228 MEDIUM Resource Exhaustion
CVE-2025-69229 MEDIUM Resource Exhaustion
CVE-2025-69226 LOW Info Exposure
CVE-2025-69230 LOW Excessive Logging

Changes

  • Security: Pinned aiohttp>=3.13.3 in requirements.txt to enforce fix
  • Added: Dependabot configuration for automated daily Python dependency checks
  • Reduced total vulnerabilities from 11 to 2 (remaining are unfixed upstream Alpine base image issues)

Remaining (unfixed upstream)

Full Changelog: v2.0.0...v2.2.1

Assets 2
Loading