T08 · Insecure Dependencies
Warning
- Location
pyproject.toml:1- Finding
Unpinned Third-Party Dependencies Allow Unreviewed Package Versions
- Content
View full analysis
=68.0", "wheel"] build-backend = "setuptools.build_meta" [project] name = "senado-federal" version = "1.1.0" description = "Cliente assíncrono para a API de Dados Abertos do Senado Federal" readme = "README.md" license = "MIT" requires-python = ">=3.11" authors = [{name = "olegantonov"}] keywords = ["senado", "senadores", "api", "brasil", "dados-abertos"] dependencies = [ "httpx>=0.27.0", ] [project.optional-dependencies] dev = [ "pytest>=8.0", "pytest-asyncio>=0.23", "pytest-cov>=5.0", "pytest-mock>=3.14", "PyYAML>=6.0", "mypy>=1.11", "ruff>=0.9", ] ``` `requirements.txt:1`: ```text httpx>=0.27.0 ``` `requirements-dev.txt:1`: ```text -e .[dev] ``` `README.md:19-28`: ```bash # Clone o repositório git clone https://github.com/olegantonov/senado-federal.git cd senado-federal # Instale as dependências pip install -r requirements.txt # Para desenvolvimento pip install -r requirements-dev.txt ``` ### Technical Analysis The project permits pip to select any available dependency version equal to or newer than the stated minimum. It does not provide a lock file, exact resolved versions, package hashes, or an installation requirement such as `--require-hashes`. Consequently, installation results can change without any modification to this repository. If a permitted dependency or transitive dependency publishes a compromised release, the documented installation commands may retrieve that release automatically. Build dependencies such as `setuptools` and `wheel` are also not pinned, so creation of an isolated build environment can resolv ...[truncated 1697 chars]- Remediation
View remediation
", "wheel==", ] ``` 5. Generate locks from a trusted index and explicitly configure the approved package repository in CI. 6. Use a controlled dependency-update process that includes vulnerability scanning, changelog review, automated tests, and manual approval. 7. Configure automated dependency monitoring, but do not automatically merge or deploy updates without validation. 8. Update the README to instruct users to install from the hash-locked file rather than directly from open-ended requirement specifications. 9. Run installation and tests in an isolated, least-privileged environment without production credentials. ]]>