Changed Readme.md for installation guide and added universal requirements.txt for easy installation #730
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| -r backend/requirements.txt | ||
| -r docs/requirements.txt | ||
| -r sync-microservice/requirements.txt | ||
|
Comment on lines
+1
to
+3
Contributor
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
# Verify subdirectory requirement files exist and check their content
echo "=== Checking subdirectory requirement files ==="
for file in backend/requirements.txt docs/requirements.txt sync-microservice/requirements.txt; do
if [ -f "$file" ]; then
echo "✓ Found: $file"
echo " Content:"
head -20 "$file" | sed 's/^/ /'
else
echo "✗ Missing: $file"
fi
doneRepository: AOSSIE-Org/PictoPy Length of output: 1264 🏁 Script executed: #!/bin/bash
# List all files in repository to understand structure
echo "=== Repository structure ==="
git ls-files | head -50Repository: AOSSIE-Org/PictoPy Length of output: 1754 🏁 Script executed: #!/bin/bash
# Check for more details on h11 versions in requirements
echo "=== h11 versions across requirement files ==="
rg "h11==" backend/requirements.txt sync-microservice/requirements.txt docs/requirements.txt 2>/dev/null || echo "h11 not found in some files"
echo -e "\n=== Complete backend/requirements.txt ==="
cat backend/requirements.txt 2>/dev/null || echo "Cannot read backend/requirements.txt"Repository: AOSSIE-Org/PictoPy Length of output: 1583 🌐 Web query:
💡 Result: Short answer: This is CVE-2025-43859. h11 (≤0.14.0) accepted malformed Chunked-Encoding terminators (it accepted any two bytes instead of strict CRLF), which can enable HTTP request smuggling when paired with a buggy proxy — not a simple DoS. The bug was disclosed Apr 24, 2025 and patched in h11 0.16.0; upgrade h11 to ≥0.16.0 (or fix/update any reverse/proxy that might parse chunked bodies). [1][2][3] Sources:
References: 🌐 Web query:
💡 Result: Short summary
Impact
Vulnerabilities / identifiers
Action you should take
References
If you want, tell me your current jinja2 version (pip show jinja2) and I can give exact pip/poetry/apt/yum upgrade commands. Update backend/requirements.txt to fix critical vulnerabilities; subdirectory files exist but have inconsistent dependency versions. All three referenced subdirectory requirement files exist. However, backend/requirements.txt contains critical vulnerabilities:
Meanwhile, sync-microservice/requirements.txt already uses patched versions (h11==0.16.0, Jinja2==3.1.6). Update backend/requirements.txt to align with these patched versions before merging. 🧰 Tools🪛 OSV Scanner (2.3.0)[HIGH] 1-1: jinja2 3.1.4: Jinja2 vulnerable to sandbox breakout through attr filter selecting format method [HIGH] 1-1: jinja2 3.1.4: Jinja has a sandbox breakout through malicious filenames [HIGH] 1-1: jinja2 3.1.4: Jinja has a sandbox breakout through indirect reference to format method [HIGH] 1-1: certifi 2024.2.2: undefined (PYSEC-2024-230) [HIGH] 1-1: certifi 2024.2.2: Certifi removes GLOBALTRUST root certificate [CRITICAL] 1-1: h11 0.14.0: h11 accepts some malformed Chunked-Encoding bodies [HIGH] 1-1: protobuf 5.26.1: protobuf-python has a potential Denial of Service issue [HIGH] 1-1: python-multipart 0.0.9: Denial of service (DoS) via deformation [HIGH] 1-1: setuptools 66.1.1: undefined (PYSEC-2025-49) [HIGH] 1-1: setuptools 66.1.1: setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write [HIGH] 1-1: setuptools 66.1.1: setuptools vulnerable to Command Injection via package URL [HIGH] 1-1: starlette 0.37.2: Starlette has possible denial-of-service vector when parsing large files in multipart forms [HIGH] 1-1: starlette 0.37.2: Starlette Denial of service (DoS) via multipart/form-data [HIGH] 1-1: starlette 0.47.2: Starlette vulnerable to O(n^2) DoS via Range header merging in [HIGH] 1-1: urllib3 2.5.0: urllib3 streaming API improperly handles highly compressed data [HIGH] 1-1: urllib3 2.5.0: urllib3 allows an unbounded number of links in the decompression chain 🤖 Prompt for AI Agents |
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
Repository: AOSSIE-Org/PictoPy
Length of output: 4718
Clarify what the Installation section accomplishes.
The Installation section is minimal and potentially confusing about scope:
mkdocs serve) serves the documentation site, not the application itself. This is unclear without additional context.While the README does direct contributors to CONTRIBUTING.md (line 10) for detailed setup, the Installation section itself should clarify that these steps set up the documentation environment. Consider adding a brief note like: "The steps above serve the documentation. For running the backend API or desktop application, see CONTRIBUTING.md."
🤖 Prompt for AI Agents