From c0891591a3e26971c8a3c5d277c1d84ab602a712 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rub=C3=A9n=20De=20la=20Torre=20Vico?= <98956809+puchy22@users.noreply.github.com> Date: Wed, 28 Oct 2026 12:18:44 +0100 Subject: [PATCH] fix(mcp): patch Authlib and dnspython CVEs flagged by Trivy (#13186) --- .../authlib-dnspython-bump.security.md | 1 + mcp_server/pyproject.toml | 5 +++-- mcp_server/uv.lock | 20 ++++++++++--------- 3 files changed, 15 insertions(+), 11 deletions(-) create mode 100644 mcp_server/changelog.d/authlib-dnspython-bump.security.md diff --git a/mcp_server/changelog.d/authlib-dnspython-bump.security.md b/mcp_server/changelog.d/authlib-dnspython-bump.security.md new file mode 100644 index 0000000000..f905b67ce0 --- /dev/null +++ b/mcp_server/changelog.d/authlib-dnspython-bump.security.md @@ -0,0 +1 @@ +Authlib from 1.7.2 to 1.9.1 and dnspython from 2.8.0 to 2.9.0 in the MCP Server container image, patching CVE-2026-96760 (critical), CVE-2026-114615, CVE-2026-114616 and CVE-2026-114605 diff --git a/mcp_server/pyproject.toml b/mcp_server/pyproject.toml index e6ae26fe32..c6f925e92d 100644 --- a/mcp_server/pyproject.toml +++ b/mcp_server/pyproject.toml @@ -74,13 +74,14 @@ extend-select = [ ] [tool.uv] -package = true - # Transitive pins fastmcp does not raise on its own; each carries a known HIGH. constraint-dependencies = [ + "authlib==1.9.1", "cryptography==50.0.0", + "dnspython==2.9.0", "joserfc==1.6.8", "mcp==1.28.1", "pyjwt==2.14.0", "python-multipart==0.0.30" ] +package = true diff --git a/mcp_server/uv.lock b/mcp_server/uv.lock index 6a33a7bc97..9641e51974 100644 --- a/mcp_server/uv.lock +++ b/mcp_server/uv.lock @@ -1,5 +1,5 @@ version = 1 -revision = 2 +revision = 5 requires-python = ">=3.12" resolution-markers = [ "python_full_version >= '3.14' and sys_platform == 'win32'", @@ -10,7 +10,9 @@ resolution-markers = [ [manifest] constraints = [ + { name = "authlib", specifier = "==1.9.1" }, { name = "cryptography", specifier = "==50.0.0" }, + { name = "dnspython", specifier = "==2.9.0" }, { name = "joserfc", specifier = "==1.6.8" }, { name = "mcp", specifier = "==1.28.1" }, { name = "pyjwt", specifier = "==2.14.0" }, @@ -62,15 +64,15 @@ wheels = [ [[package]] name = "authlib" -version = "1.7.2" +version = "1.9.1" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "cryptography" }, { name = "joserfc" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/36/98/7d93f30d029643c0275dbc0bd6d5a6f670661ee6c9a94d93af7ab4887600/authlib-1.7.2.tar.gz", hash = "sha256:2cea25fefcd4e7173bdf1372c0afc265c8034b23a8cd5dcb6a9164b826c64231", size = 176511, upload-time = "2026-05-06T08:10:23.116Z" } +sdist = { url = "https://files.pythonhosted.org/packages/c9/dc/087c08741a98d234c9b98beef8a28d3c309f814d14b6156422c5815bf6d6/authlib-1.9.1.tar.gz", hash = "sha256:5c7d9848f47cac340f060f76ae0bc09b59f5c8e89cc1bb032d4370a0c55b5974", size = 182700, upload-time = "2026-10-14T14:17:52.307Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/fb/95/adcb68e20c34162e9135f370d6e31737719c2b6f94bc953fe7ed1f10fe21/authlib-1.7.2-py2.py3-none-any.whl", hash = "sha256:3e1faedc9d87e7d56a164eca3ccb6ace0d61b94abe83e92242f8dc8bba9b4a9f", size = 259548, upload-time = "2026-05-06T08:10:21.436Z" }, + { url = "https://files.pythonhosted.org/packages/39/44/a46089266de32a0d809023b6bf31b80a1f26a46954446a7ce695a565cbea/authlib-1.9.1-py2.py3-none-any.whl", hash = "sha256:8b9be8b1e5174dcbf5520e984f1a22dc2edae5b6e40a61d4cedbf86b97e9e69b", size = 266042, upload-time = "2026-10-14T14:17:50.695Z" }, ] [[package]] @@ -350,11 +352,11 @@ wheels = [ [[package]] name = "dnspython" -version = "2.8.0" +version = "2.9.0" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/8c/8b/57666417c0f90f08bcafa776861060426765fdb422eb10212086fb811d26/dnspython-2.8.0.tar.gz", hash = "sha256:181d3c6996452cb1189c4046c61599b84a5a86e099562ffde77d26984ff26d0f", size = 368251, upload-time = "2025-09-07T18:58:00.022Z" } +sdist = { url = "https://files.pythonhosted.org/packages/ef/4a/50822184bd67cc6493f0fb6a880749158fcd31ab3fa07409acfd91f9fc85/dnspython-2.9.0.tar.gz", hash = "sha256:b44dc6b18f07a8b1c56676a19fbfdb5209415b046a9cece286baafa87ff3f7f1", size = 423560, upload-time = "2026-10-09T00:07:24.352Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/ba/5a/18ad964b0086c6e62e2e7500f7edc89e3faa45033c71c1893d34eed2b2de/dnspython-2.8.0-py3-none-any.whl", hash = "sha256:01d9bbc4a2d76bf0db7c1f729812ded6d912bd318d3b1cf81d30c0f845dbf3af", size = 331094, upload-time = "2025-09-07T18:57:58.071Z" }, + { url = "https://files.pythonhosted.org/packages/10/02/cdcc9b7c051786a103c3b09e1003a82fa0c66bcb91ffbdabcfbf7b4163b9/dnspython-2.9.0-py3-none-any.whl", hash = "sha256:9a4aedb833c3c1b49214d04d44d3032ab7a9135f7c1d29a549b4ff78fd82fda9", size = 354822, upload-time = "2026-10-09T00:07:22.622Z" }, ] [[package]] @@ -1293,8 +1295,8 @@ name = "secretstorage" version = "3.5.0" source = { registry = "https://pypi.org/simple" } dependencies = [ - { name = "cryptography", marker = "sys_platform != 'win32'" }, - { name = "jeepney", marker = "sys_platform != 'win32'" }, + { name = "cryptography" }, + { name = "jeepney" }, ] sdist = { url = "https://files.pythonhosted.org/packages/1c/03/e834bcd866f2f8a49a85eaff47340affa3bfa391ee9912a952a1faa68c7b/secretstorage-3.5.0.tar.gz", hash = "sha256:f04b8e4689cbce351744d5537bf6b1329c6fc68f91fa666f60a380edddcd11be", size = 19884, upload-time = "2025-11-23T19:02:53.191Z" } wheels = [