Starstruk Logo MarkStarstruk

v4.5.0.1

higress-group/higressv4.5.0.1May 19, 2026by sid-swirl

AI Summary

A security patch that re-freezes Python dependencies to address ~30 reported vulnerabilities, including 2 critical CVEs.

Key Highlights

  • Addressed 2 critical CVEs (nltk and litellm).
  • Addressed 26 high-severity CVEs across multiple libraries.
  • Updated dependencies (openai, snowflake-connector-python, cffi).

Full Release Notes

# šŸ”’ SWIRL Community 4.5.0.1 ā€” Security Patch

This release re-freezes Python dependencies to clear ~30 vulnerabilities reported by Docker Scout. No SWIRL application code changed.

ā­ PLEASE STAR OUR REPO: [https://github.com/swirlai/swirl-search](https://github.com/swirlai/swirl-search)
šŸŒ PLEASE VISIT OUR WEBSITE: [https://www.swirlaiconnect.com/](https://www.swirlaiconnect.com/)

---

## Updates

āš ļø **2 critical CVEs** addressed (CVSS ā‰„ 9.0):

- `nltk 3.9.2 ā†’ 3.9.4` ā€” **CVE-2025-14009** (CVSS 10.0)
- `litellm 1.83.0 ā†’ 1.83.10` ā€” **CVE-2026-42208** (CVSS 9.3)

Plus 26 high-severity CVEs across `Django`, `urllib3`, `cryptography`, `ujson`, `pyOpenSSL`, `lxml`, `PyJWT`, `pyasn1`, `azure-core`, `cbor2`, `protobuf`, `orjson`, and previously-transitive `wheel` + `jaraco.context`.

Some upstream constraints forced additional version moves:

- `openai 2.9.0 ā†’ 2.24.0` ā€” required by `litellm 1.83.10`
- `snowflake-connector-python 3.17.3 ā†’ 4.5.0` ā€” required for `cffi 2.0.0` (which `cryptography 46.0.5` requires)
- `cffi 1.17.1 ā†’ 2.0.0`

The OpenAI integration path has been re-validated against both OpenAI and Anthropic models via LiteLLM.

## Deferred

- `twisted 25.5.0 ā†’ 26.4.0` ā€” fix is currently only available as a release candidate (`26.4.0rc2`). Will be picked up in 4.5.1 / 4.6 once `26.4.0` final ships. The associated CVE-2026-42304 (CVSS 7.5) is acknowledged but does not affect the SWIRL request path in normal deployment.

## Upgrading

āš ļø **No database migration required.** 4.5.0.1 is a drop-in replacement for 4.5.0.0.