[Auto-generated] Update requirements.txt

.github/utils/direct_requirements.txt

@@ -1,7 +1,7 @@
-fastapi-slim>=0.128.5
+fastapi-slim>=0.129.0
 hypercorn>=0.17.3
 oteapi-core>=1.0.1
 pydantic>=2.12.5
-pydantic-settings>=2.12.0
-redis>=7.1.0
+pydantic-settings>=2.13.0
+redis>=7.1.1
 tenacity>=9.1.4

.github/workflows/ci_tests.yml

@@ -35,6 +35,12 @@ jobs:
       uses: pypa/gh-action-pip-audit@v1.1.0
       with:
         inputs: requirements.txt .dev/requirements_ci.txt .dev/requirements_dev.txt .dev/requirements_docker_dev.txt .dev/requirements_release.txt
+        # CVE-2025-69872: DiskCache 5.6.3
+        #   DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default.
+        #   An attacker with write access to the cache directory can achieve arbitrary code execution
+        #   when a victim application reads from the cache.
+        ignore-vulns: |
+          CVE-2025-69872
 
     - name: Fail if pre-commit failed
       run: |

Dockerfile

@@ -55,7 +55,12 @@ RUN python -m venv /tmp/dev_venv \
 # Run static security check, linters, and pytest with code coverage
 RUN --mount=type=cache,target=/root/.cache/pre-commit \
   git init && git add . && /tmp/dev_venv/bin/pre-commit run -c .pre-commit-config_docker.yaml --all-files
-RUN /tmp/dev_venv/bin/pip-audit -r /app/requirements.txt --desc on
+
+# CVE-2025-69872: DiskCache 5.6.3
+#   DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default.
+#   An attacker with write access to the cache directory can achieve arbitrary code execution
+#   when a victim application reads from the cache.
+RUN /tmp/dev_venv/bin/pip-audit -r /app/requirements.txt --desc on --ignore-vuln CVE-2025-69872
 
 # Install extra (non-dev tools) development requirements in main environment
 RUN pip install -q -U -r requirements_dev.txt

README.md

@@ -4,6 +4,11 @@
 To use a version of the `oteapi` Docker image that runs only on the latest stable version of `oteapi-core`, use the version tag `1.20240228.345` or earlier.
 Example: `ghcr.io/emmc-asbl/oteapi:1.20240228.345`.
 
+> **Warning**: There is currently a security vulnerability in the `oteapi` Docker image that is caused by the use of `diskcache` version 5.6.3.
+> This vulnerability is tracked as [CVE-2025-69872](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69872).
+> The vulnerability is mitigated by the fact that an attacker would need write access to the cache directory to achieve arbitrary code execution, and this is not the case for the default configuration of the `oteapi` Docker image.
+> However, if you are using a custom configuration that allows write access to the cache directory, please be aware of this vulnerability and take appropriate measures to secure your system.
+
 ## Run in Docker
 
 ### Development target

requirements.txt

@@ -13,11 +13,12 @@ click==8.3.1
 click-didyoumean==0.3.1
 click-plugins==1.1.1.2
 click-repl==0.3.0
-cryptography==46.0.4
+cryptography==46.0.5
 diskcache==5.6.3
 et_xmlfile==2.0.0
 exceptiongroup==1.3.1
-fastapi-slim==0.128.5
+fastapi==0.129.0
+fastapi-slim==0.129.0
 h11==0.16.0
 h2==4.3.0
 hpack==4.1.0
@@ -29,20 +30,20 @@ openpyxl==3.1.5
 oteapi-core==1.0.1
 packaging==26.0
 paramiko==3.5.1
-pillow==12.1.0
+pillow==12.1.1
 priority==2.0.0
 prompt_toolkit==3.0.52
 psycopg==3.3.2
 psycopg-binary==3.3.2
 pycparser==3.0
 pydantic==2.12.5
-pydantic-settings==2.12.0
+pydantic-settings==2.13.0
 pydantic_core==2.41.5
 PyNaCl==1.6.2
 pysftp==0.2.9
 python-dateutil==2.9.0.post0
 python-dotenv==1.2.1
-redis==7.1.0
+redis==7.1.1
 requests==2.32.5
 six==1.17.0
 starlette==0.52.1