Fix HIGH-severity vulnerabilities in runtime Python deps (dynaconf RCE, urllib3, python-multipart, lupa)

[yedidyakfir]

Summary

Dependabot has flagged several HIGH-severity vulnerabilities in runtime Python dependencies (resolved in uv.lock). These ship in deployed code and are the top priority to remediate.

Source: GitHub → Security → Dependabot alerts.

Affected packages

Package	Advisory	Current → Fixed	GHSA
dynaconf	RCE via insecure @jinja template evaluation	≤3.2.12 → 3.2.13	GHSA-pxrr-hq57-q35p
urllib3	Sensitive headers forwarded across origins on proxied redirect	<2.7.0 → 2.7.0	GHSA-qccp-gfcp-xxvc
urllib3	Decompression-bomb safeguards bypassed in streaming API	≥2.6.0,<2.7.0 → 2.7.0	GHSA-mf9v-mfxr-j63j
python-multipart	DoS via unbounded multipart part headers	<0.0.27 → 0.0.27	GHSA-pp6c-gr5w-3c5g
lupa	Sandbox escape + RCE via incomplete attribute_filter	≤2.6 → no patch yet	GHSA-69v7-xpr6-6gjm

Implementation Considerations

• All resolved in uv.lock; most are transitive. Fix with:

  uv lock --upgrade-package dynaconf --upgrade-package urllib3 --upgrade-package python-multipart
  uv sync

• If a pyproject.toml constraint caps a package below the fixed version, raise it first.
• lupa has no fixed release — assess exposure (is Lua reachable with untrusted input?), subscribe to the GHSA, and dismiss with a documented reason if exposure is low.
• Run the full test suite before committing the updated lockfile.

List tasks

• Bump dynaconf to ≥3.2.13
• Bump urllib3 to ≥2.7.0
• Bump python-multipart to ≥0.0.27
• Assess lupa exposure and document decision (no patch available)
• Run test suite and commit updated uv.lock
• Confirm alerts cleared in Dependabot

[github-actions]

Closed by #124.

[github-actions]

Closed by #125.