Patch workflow-use CVEs: starlette (via fastapi bump) and vite#163
Conversation
Clears the four Dependabot advisories labeled workflow-use. Python (workflows/): - Bump fastapi 0.115.12 -> 0.139.2. The old pin capped starlette < 0.47.0, which was the only thing holding starlette at the vulnerable 0.46.2; 0.139.2 requires starlette>=0.46.0 with no upper bound. - Add starlette>=1.3.1 to constraint-dependencies. Resolves starlette 0.46.2 -> 1.3.1, clearing CVE-2025-62727 (<= 0.49.0), CVE-2026-48818 (< 1.1.0) and CVE-2026-54283 (< 1.3.1). UI (ui/): - Bump vite 5.4.21 -> 6.4.3, clearing CVE-2026-53571 (<= 6.4.2, Windows server.fs.deny bypass). Fixed only in 6.4.3/7.3.5/8.0.16; no 5.x backport. Matches the version extension/ already uses. Verified: uv sync + import of the FastAPI recorder app, MCP service and WorkflowController (24 actions); npm install + vite build in ui/.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ba72fa26a1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "cryptography>=48.0.1", # CVE-2026-26007 / GHSA-537c-gmf6-5ccf (< 48.0.1) | ||
| "pillow>=12.2.0", # CVE-2026-40192 / CVE-2026-42311 / CVE-2026-25990 (< 12.2.0) | ||
| "soupsieve>=2.8.4", # CVE-2026-49476 / CVE-2026-49477 (<= 2.8.3) | ||
| "starlette>=1.3.1", # CVE-2025-62727 (<= 0.49.0) / CVE-2026-48818 (< 1.1.0) / CVE-2026-54283 (< 1.3.1); needs fastapi>=0.139 |
There was a problem hiding this comment.
When this package is built/published or installed with pip instead of uv sync, this resolver-only constraint-dependencies entry is not emitted as a Requires-Dist dependency (the updated workflow-use lock metadata still lists fastapi but no starlette). In an environment that already has vulnerable Starlette 0.46.2, fastapi==0.139.2 can be satisfied without upgrading Starlette, so the CVE fix only applies to uv-managed installs rather than package consumers. Move the Starlette floor into [project].dependencies so installers enforce it.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Good catch — fixed in ad21565. Moved the floor into [project.dependencies] as a direct pin starlette==1.3.1 (matching the repo's exact-pin convention) and dropped the resolver-only constraint-dependencies entry. Confirmed the built wheel's METADATA now carries Requires-Dist: starlette==1.3.1, so pip installs enforce the upgrade even over a pre-existing vulnerable starlette.
There was a problem hiding this comment.
Pull request overview
Updates pinned dependencies in the workflow-use Python package and the ui frontend to remediate Dependabot-reported vulnerabilities (Starlette CVEs via FastAPI bump + explicit Starlette floor; Vite CVE via Vite bump), keeping the repo’s lockfiles aligned with the new resolved versions.
Changes:
- Python (
workflows/): bumpfastapito0.139.2and enforcestarlette>=1.3.1via UV constraints / lockfile resolution. - UI (
ui/): bumpviteto6.4.3and update the npm lockfile to the new dependency tree (incl. Vite’s updated transitive deps likeesbuild).
Reviewed changes
Copilot reviewed 2 out of 4 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| workflows/uv.lock | Updates resolved Python dependency set to include fastapi==0.139.2 and starlette==1.3.1 (plus new transitive deps). |
| workflows/pyproject.toml | Bumps fastapi pin and adds starlette>=1.3.1 to constraint-dependencies for security floors. |
| ui/package.json | Bumps vite to 6.4.3. |
| ui/package-lock.json | Updates the full npm resolution for the Vite 6 upgrade (new/updated transitive packages and metadata). |
Files not reviewed (1)
- ui/package-lock.json: Generated file
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Address Codex review: `[tool.uv] constraint-dependencies` is resolver-only and never emitted as Requires-Dist, so `pip install workflow-use` into an env that already has the vulnerable starlette 0.46.2 would keep it (fastapi 0.139.2 only needs starlette>=0.46.0). Move the floor into [project.dependencies] as a direct pin (starlette==1.3.1, matching the repo's exact-pin convention) and drop the constraint entry. Verified the built wheel's METADATA now lists `Requires-Dist: starlette==1.3.1`.
| }, | ||
| "overrides": { |
Clears the four Dependabot advisories labeled workflow-use.
Python (
workflows/) — starlette CVEsfastapi 0.115.12 → 0.139.2. The old pin cappedstarlette < 0.47.0, which was the only thing holding starlette at the vulnerable0.46.2;0.139.2requiresstarlette>=0.46.0with no upper bound.starlette>=1.3.1toconstraint-dependencies.0.46.2 → 1.3.1, clearing:<= 0.49.0)< 1.1.0)< 1.3.1)browser-use 0.13.4's hard-pinmcp==1.26.0allowsstarlette>=0.27, so there's no conflict. Since fastapi no longer caps starlette,pip install workflow-useconsumers also auto-resolve to fixed starlette.UI (
ui/) — vite CVEvite 5.4.21 → 6.4.3, clearing CVE-2026-53571 (<= 6.4.2, Windowsserver.fs.denybypass). Fixed only in 6.4.3 / 7.3.5 / 8.0.16 — no 5.x backport. Matches the versionextension/already uses.Verification
uv syncclean; imported starlette 1.3.1 / fastapi 0.139.2, instantiated the recorderFastAPIapp (5 routes),get_mcp_server, andWorkflowController(24 actions).npm installdeduped vite 6.4.3 under@vitejs/plugin-react+@tailwindcss/vite;vite buildsucceeded (243 modules);npm auditno longer flags vite.Scope
Strictly the workflow-use advisories. The
browsercode/sdkadvisories belong to other repos and are untouched.Summary by cubic
Patches workflow-use security advisories by upgrading
fastapi, pinningstarlette1.3.1, and bumpingvitein the UI. Clears all alerts with no behavior changes.fastapi0.115.12 → 0.139.2 and pinstarlette==1.3.1(via Requires-Dist) → resolvesstarlette0.46.2 → 1.3.1; clears CVE-2025-62727, CVE-2026-48818, CVE-2026-54283.vite5.4.21 → 6.4.3; fixes CVE-2026-53571 (Windows server.fs.deny bypass).Written for commit ad21565. Summary will update on new commits.