fix(deps): bump vulnerable packages (CVE remediation)

VTvito · VTvito · commit ff1f5d076b21 · 2026-03-01T19:18:04.000+01:00
gunicorn 21.2.0 -> 23.0.0 (all 11 services + template) Fixes GHSA-hc5x-x2vx-497g (HTTP Request Smuggling) GHSA-w3h3-4rj7-4ph4 (HTTP header injection) requests 2.32.3 -> 2.32.4 (extract-api-service) Fixes GHSA-9hjg-9r4m-mvj7 transformers 4.48.3 -> 4.53.0 (text-completion-llm-service) Fixes 11 CVEs: GHSA-37mw, GHSA-4w7r, GHSA-59p9, GHSA-9356, GHSA-fpwr, GHSA-jjph, GHSA-phhr, GHSA-q2wp, GHSA-qq3j, GHSA-rcv9, PYSEC-2025-40 torch 2.6.0 -> 2.7.0 (text-completion-llm-service) Partially fixes GHSA-3749-ghw9-m3mg, GHSA-887c-mr87-cxwp NOTE: full fix requires 2.8.0 when released .github/copilot-instructions.md: update tech stack table gunicorn 21.2.x -> 23.0.x, Airflow latest -> 2.10.4 (pinned)
diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
@@ -621,10 +621,10 @@ These are hard-won insights from building and debugging the platform. They shoul
 |---|---|---|---|
 | **Runtime** | Python | 3.9 | All services and tools |
 | **Web framework** | Flask | 3.0.x | Blueprint pattern, app factory |
-| **WSGI server** | Gunicorn | 21.2.x | 4 workers default |
+| **WSGI server** | Gunicorn | 23.0.x | 4 workers default |
 | **Data format** | Apache Arrow IPC | PyArrow 18.x | Streaming format for all service data |
 | **Data processing** | Pandas | 2.2.x | Arrow → Pandas → process → Arrow (consider pyarrow.compute for perf-critical paths) |
-| **Orchestration** | Apache Airflow | latest | PostgreSQL backend, DAG-based |
+| **Orchestration** | Apache Airflow | 2.10.4 | PostgreSQL 16 backend, DAG-based |
 | **AI (cloud)** | OpenAI API | GPT-4o-mini default | Pipeline generation |
 | **AI (local)** | HuggingFace Transformers | Llama 3.2 1B Instruct | Text completion service |
 | **UI** | Streamlit | 1.30+ | Chat + pipeline builder + data preview/download + health dashboard |
diff --git a/services/clean-nan-service/requirements.txt b/services/clean-nan-service/requirements.txt
@@ -1,6 +1,6 @@
 Flask==3.1.3
 Werkzeug==3.1.6
-gunicorn==21.2.0
+gunicorn==23.0.0
 numpy==2.0.2
 pandas==2.2.2
 prometheus_client==0.21.0
diff --git a/services/data-quality-service/requirements.txt b/services/data-quality-service/requirements.txt
@@ -1,6 +1,6 @@
 Flask==3.1.3
 Werkzeug==3.1.6
-gunicorn==21.2.0
+gunicorn==23.0.0
 numpy==2.0.2
 pandas==2.2.2
 prometheus_client==0.21.0
diff --git a/services/delete-columns-service/requirements.txt b/services/delete-columns-service/requirements.txt
@@ -1,6 +1,6 @@
 Flask==3.1.3
 Werkzeug==3.1.6
-gunicorn==21.2.0
+gunicorn==23.0.0
 numpy==2.0.2
 pandas==2.2.2
 prometheus_client==0.21.0
diff --git a/services/extract-api-service/requirements.txt b/services/extract-api-service/requirements.txt
@@ -1,8 +1,8 @@
 Flask==3.1.3
 Werkzeug==3.1.6
-gunicorn==21.2.0
+gunicorn==23.0.0
 numpy==2.0.2
 pandas==2.2.2
 prometheus_client==0.21.0
-requests==2.32.3
+requests==2.32.4
 pyarrow==18.1.0
diff --git a/services/extract-csv-service/requirements.txt b/services/extract-csv-service/requirements.txt
@@ -1,6 +1,6 @@
 Flask==3.1.3
 Werkzeug==3.1.6
-gunicorn==21.2.0
+gunicorn==23.0.0
 numpy==2.0.2
 pandas==2.2.2
 prometheus_client==0.21.0
diff --git a/services/extract-excel-service/requirements.txt b/services/extract-excel-service/requirements.txt
@@ -1,6 +1,6 @@
 Flask==3.1.3
 Werkzeug==3.1.6
-gunicorn==21.2.0
+gunicorn==23.0.0
 numpy==2.0.2
 pandas==2.2.2
 prometheus_client==0.21.0
diff --git a/services/extract-sql-service/requirements.txt b/services/extract-sql-service/requirements.txt
@@ -1,6 +1,6 @@
 Flask==3.1.3
 Werkzeug==3.1.6
-gunicorn==21.2.0
+gunicorn==23.0.0
 numpy==2.0.2
 pandas==2.2.2
 prometheus_client==0.21.0
diff --git a/services/join-datasets-service/requirements.txt b/services/join-datasets-service/requirements.txt
@@ -1,6 +1,6 @@
 Flask==3.1.3
 Werkzeug==3.1.6
-gunicorn==21.2.0
+gunicorn==23.0.0
 numpy==2.0.2
 pandas==2.2.2
 prometheus_client==0.21.0
diff --git a/services/load-data-service/requirements.txt b/services/load-data-service/requirements.txt
@@ -1,6 +1,6 @@
 Flask==3.1.3
 Werkzeug==3.1.6
-gunicorn==21.2.0
+gunicorn==23.0.0
 prometheus_client==0.21.0
 pyarrow==18.1.0
 pandas==2.2.2
diff --git a/services/outlier-detection-service/requirements.txt b/services/outlier-detection-service/requirements.txt
@@ -1,6 +1,6 @@
 Flask==3.1.3
 Werkzeug==3.1.6
-gunicorn==21.2.0
+gunicorn==23.0.0
 numpy==2.0.2
 pandas==2.2.2
 prometheus_client==0.21.0
diff --git a/services/text-completion-llm-service/requirements.txt b/services/text-completion-llm-service/requirements.txt
@@ -1,9 +1,9 @@
 Flask==3.1.3
 Werkzeug==3.1.6
-gunicorn==21.2.0
+gunicorn==23.0.0
 numpy==2.0.2
 pandas==2.2.2
 prometheus_client==0.21.0
 pyarrow==18.1.0
-transformers==4.48.3
-torch==2.6.0
+transformers==4.53.0
+torch==2.7.0
diff --git a/templates/new_service/requirements.txt b/templates/new_service/requirements.txt
@@ -1,6 +1,6 @@
 Flask==3.1.3
 Werkzeug==3.1.6
-gunicorn==21.2.0
+gunicorn==23.0.0
 numpy==2.0.2
 pandas==2.2.2
 prometheus_client==0.21.0
