* **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
passed to APIs that accept Python buffers, which could lead to buffer
overflow. **CVE-2026-39892**
* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
.. _v46-0-6:
46.0.6 - 2026-03-25
SECURITY ISSUE: Fixed a bug where name constraints were not applied
to peer names during verification when the leaf certificate contains a
wildcard DNS SAN. Ordinary X.509 topologies are not affected by this bug,
including those used by the Web PKI. Credit to Oleh Konko (1seal) for
reporting the issue. CVE-2026-34073
release(text-splitters): 1.1.2 (#36822)
fix(text-splitters): deprecate and use SSRF-safe transport in split_text_from_url (#36821)
chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/text-splitters (#36797)
chore(deps): bump pytest to 9.0.3 (#36801)
chore: bump pytest from 9.0.2 to 9.0.3 in /libs/text-splitters (#36714)
chore: add comment explaining pygments>=2.20.0 (#36570)
release(core): 1.2.26 (#36511)
chore: pygments>=2.20.0 across all packages (CVE-2026-4539) (#36385)
fix(text-splitters): prevent silent data loss for empty dict values in RecursiveJsonSplitter (#35079)
feat(text-splitters): support spacy tests with Python 3.14 (#36198)
fix(infra): correct lint_diff relative paths in package makefiles (#36333)
chore: bump requests from 2.32.5 to 2.33.0 in /libs/text-splitters (#36238)
chore: bump nltk from 3.9.3 to 3.9.4 in /libs/text-splitters (#36237)
chore(partners): bump langchain-core min to 1.2.21 (#36183)
chore(text-splitters): bump nltk in lock file (#36112)
ci: suppress pytest streaming output in CI (#36092)
chore(text-splitters): speed up ci (#36050)
ci: avoid unnecessary dep installs in lint targets (#36046)
chore: bump orjson from 3.11.5 to 3.11.6 in /libs/text-splitters (#35856)
chore: bump locks, lint (#35985)
perf(.github): set a timeout on get min versions HTTP calls (#35851)
chore: bump tornado from 6.5.2 to 6.5.5 in /libs/text-splitters (#35774)
chore: bump the minor-and-patch group across 3 directories with 3 updates (#35589)
chore: bump the other-deps group across 3 directories with 2 updates (#35512)
chore: bump nltk from 3.9.2 to 3.9.3 in /libs/text-splitters (#35449)
chore: bump the other-deps group across 3 directories with 2 updates (#35407)
Fix ALINE feature matrix errors and add comprehensive tests
Support multiple VerbNet versions, fix longid/shortid regex for VerbNet ids
Let downloader fallback to md5 when sha256 is unavailable
Several other minor bugfixes and code cleanups
Thanks to the following contributors to 3.9.4:
Min-Yen Kan, Eric Kafe, Emily Voss, bowiechen, Hrudhai01,
jancallewaert, Mr-Neutr0n, pollak.peter89, ylwango613,
Version 3.9.3 2026-02-21
Fix CVE-2025-14009: secure ZIP extraction in nltk.downloader (#3468)
Block path traversal/arbitrary reads in nltk.data for protocol-less refs (#3467)
Block path traversal/abs paths in corpus readers and FS pointers (#3479, #3480)
Validate external StanfordSegmenter JARs using SHA256 (#3477)
Add optional sandbox enforcement for filestring() (#3485)
new environment variable NLTK_DOWNLOADER_FORCE_INTERACTIVE_SHELL
Lesk defaults to most frequent sense in case of ties
Thanks to the following contributors to 3.9.2:
Jose Cols, Peter de Blanc, GeneralPoxter, Eric Kafe, William LaCroix, Jason Liu,
Samer Masterson, Mike014, purificant, Andrew Ernest Ritz, samertm, Ikram Ul Haq,
Christopher Smith, Ryan Mannion
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/open-webui/open-webui/pull/24442
Author: @dependabot[bot]
Created: 5/8/2026
Status: ❌ Closed
Base:
main← Head:dependabot/pip/pip-0ed024d7f6📝 Commits (1)
283f69eBump the pip group across 2 directories with 8 updates📊 Changes
3 files changed (+21 additions, -21 deletions)
View changed files
📝
backend/requirements-min.txt(+3 -3)📝
backend/requirements.txt(+9 -9)📝
pyproject.toml(+9 -9)📄 Description
Bumps the pip group with 8 updates in the / directory:
0.0.220.0.2746.0.546.0.71.6.101.6.110.86.00.87.01.1.11.1.26.7.56.10.23.9.33.9.412.1.112.2.0Bumps the pip group with 8 updates in the /backend directory:
0.0.220.0.2746.0.546.0.71.6.101.6.110.86.00.87.01.1.11.1.26.7.56.10.23.9.33.9.412.1.112.2.0Updates
python-multipartfrom 0.0.22 to 0.0.27Release notes
Sourced from python-multipart's releases.
Changelog
Sourced from python-multipart's changelog.
Commits
6d1d689Version 0.0.27 (#272)0b10220Run CI on main branch pull requests (#271)3e64f5fAdd multipart header limits (#267)eb109ccPass parse offsets via constructors (#268)78e29abBump pytest from 9.0.2 to 9.0.3 (#266)b2ddd09fuzz: Enhance fuzzing capabilities with new chunked and boundary tests (#264)28f4785Version 0.0.26 (#263)d4452a7Silently discard epilogue data after the closing boundary (#259)6a7b76dSkip preamble before first multipart boundary (#262)4addb60Version 0.0.25 (#261)Updates
cryptographyfrom 46.0.5 to 46.0.7Changelog
Sourced from cryptography's changelog.
Commits
622d67246.0.7 release (#14602)91d7288Cherry-pick #14542 (#14543)Updates
authlibfrom 1.6.10 to 1.6.11Release notes
Sourced from authlib's releases.
Changelog
Sourced from authlib's changelog.
Commits
0dc0e5bchore: bump to 1.6.11aa7b8e4Merge commit from fork401a770fix: CSRF issue with starlette clientUpdates
anthropicfrom 0.86.0 to 0.87.0Release notes
Sourced from anthropic's releases.
Changelog
Sourced from anthropic's changelog.
Commits
ab0c446release: 0.87.06599043fix(memory): return resolved path from async _validate_path715030cfix(memory): use restrictive file mode for memory files6cdbc5fchore(tests): bump steady to v0.20.14beda3cAdd output-300k-2026-03-24 beta header3b77b82chore(ci): run builds on CI even if only spec metadata changed764ddbafeat(internal): implement indices array format for query and form serialization8a06a90codegen metadata7f8cf3cchore(tests): bump steady to v0.19.70eba0ddchore(ci): skip lint on metadata-only changesUpdates
langchain-text-splittersfrom 1.1.1 to 1.1.2Release notes
Sourced from langchain-text-splitters's releases.
Commits
58c4e5brelease(text-splitters): 1.1.2 (#36822)c289bf1fix(text-splitters): deprecate and use SSRF-safe transport in split_text_from...b7447c6fix(infra): skip serdes tests in min-version release step (#36818)41c0cc5release(openai): 1.1.14 (#36820)0516156fix(openai): use SSRF-safe transport for image token counting (#36819)338aa81fix(core): restore cloud metadata IPs and link-local range in SSRF policy (#3...51e9548chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/text-splitters (#36797)e85c418chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/model-profiles (#36798)789126echore: bump langsmith from 0.6.3 to 0.7.31 in /libs/standard-tests (#36799)937b3ebchore: bump langsmith from 0.6.3 to 0.7.31 in /libs/langchain_v1 (#36800)Updates
pypdffrom 6.7.5 to 6.10.2Release notes
Sourced from pypdf's releases.
... (truncated)
Changelog
Sourced from pypdf's changelog.
... (truncated)
Commits
c476b4fREL: 6.10.2c50a010SEC: Do not rely on possibly invalid /Size for incremental cloning (#3735)ac734daSEC: Introduce limits for FlateDecode parameters and image decoding (#3734)b49e7ebREL: 6.10.162338e9SEC: Limit the allowed size of xref and object streams (#3733)5dcc0aeDEV: Update pytest-benchmark to 5.2.3b42e4aaDEV: Update pinned pillow and pytest where possible (#3732)717446bROB: Consider strict mode setting for decryption errors (#3731)9e461d3DEV: Bump softprops/action-gh-release from 2 to 3 (#3730)500d09dTST: Updatetest_embedded_file__basicto usetmp_pathfixture (#3726)Updates
nltkfrom 3.9.3 to 3.9.4Changelog
Sourced from nltk's changelog.
... (truncated)
Commits
ad9c96bUpdate copyright year7edcddfUpdates for 3.9.4 release67a2736Merge pull request #3180 from yzhaoinuw/bug-on-edit_distance_align2b17ac5Fix edit_distance_align backtrace for high substitution costs4b72976Merge pull request #3018 from JuanIMartinezB/bug/shortid-longid8a5619fMerge pull request #3222 from Syzygy2048/feature/texttiling-vocabulary-introd...c6574d7Merge pull request #3289 from ihitamandal/codeflash/optimize-windowdiff-2024-...98ff5d9Merge pull request #3435 from Hrudhai01/fix-3260-detokenize-quotesaec4fceMerge pull request #3522 from ekaf/pathseceec4ee3Merge pull request #3526 from nltk/update-contributingUpdates
pillowfrom 12.1.1 to 12.2.0Release notes
Sourced from pillow's releases.
... (truncated)
Commits
3c41c0912.2.0 version bumpcdaa29eCheck calloc return value (#9527)585b2f5Check calloc return valueecf011eCheck all allocs in the Arrow tree (#9488)cf6de8cReject non-numeric elements inside list coords (#9526)ffdcedeUpdate 12.2.0 release notes (#9522)7929d77Added security release notes (#149)c4f7aa5Added security release notes22cdb5fMove variable declaration inside define (#9525)fc15b3bResize tall images vertically first (#9524)Updates
python-multipartfrom 0.0.22 to 0.0.27Release notes
Sourced from python-multipart's releases.
Changelog
Sourced from python-multipart's changelog.
Description has been truncated
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.