Patch vulnerable Python and web dependencies

.github/workflows/main.yml

@@ -86,6 +86,13 @@ jobs:
     steps:
       - if: matrix.container
         run: |
+          # Preserve the glibc baseline after Bullseye LTS ended. These signed,
+          # timestamped archives retain the packages removed from live mirrors.
+          cat > /etc/apt/sources.list <<'EOF'
+          deb [check-valid-until=no] http://snapshot.debian.org/archive/debian/20260831T235959Z bullseye main
+          deb [check-valid-until=no] http://snapshot.debian.org/archive/debian-security/20260831T235959Z bullseye-security main
+          deb [check-valid-until=no] http://snapshot.debian.org/archive/debian/20260831T235959Z bullseye-updates main
+          EOF
           apt-get update
           apt-get install --no-install-recommends -y git ca-certificates binutils build-essential
       - uses: mhils/workflows/checkout@acc73c7af100db9fb3f1ad3c0178d382048e943f
@@ -125,9 +132,19 @@ jobs:
           path: release/dist
 
   build-wheel:
-    uses: mhils/workflows/.github/workflows/python-build.yml@acc73c7af100db9fb3f1ad3c0178d382048e943f
-    with:
-      artifact: binaries.wheel
+    runs-on: ubuntu-latest
+    steps:
+      - uses: mhils/workflows/checkout@acc73c7af100db9fb3f1ad3c0178d382048e943f
+      - uses: mhils/workflows/setup-uv@acc73c7af100db9fb3f1ad3c0178d382048e943f
+      - uses: mhils/workflows/uv-sync@acc73c7af100db9fb3f1ad3c0178d382048e943f
+        with:
+          args: --only-group dev
+      - name: Build archives with the locked security-patched backend
+        run: sudo unshare --net -- "$(which python3)" -m build --no-isolation
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: binaries.wheel
+          path: dist/
 
   build-windows-installer:
     runs-on: windows-latest

mitmproxy/proxy/layers/http/_http_h2.py

@@ -1,5 +1,6 @@
 import collections
 import logging
+from collections.abc import Buffer
 from typing import NamedTuple
 
 import h2.config
@@ -119,7 +120,7 @@ def reset_stream(self, stream_id: int, error_code: int = 0) -> None:
         self.stream_buffers.pop(stream_id, None)
         super().reset_stream(stream_id, error_code)
 
-    def receive_data(self, data: bytes):
+    def receive_data(self, data: Buffer):
         events = super().receive_data(data)
         ret = []
         for event in events:

mitmproxy/tools/web/index.html

@@ -5,10 +5,9 @@
         <title>mitmproxy</title>
         <link rel="icon" href="static/favicon.ico" type="image/x-icon" />
         <meta name="viewport" content="width=device-width, initial-scale=1" />
-      <script type="module" crossorigin src="./static/index-Be7e-cwP.js"></script>
-      <link rel="modulepreload" crossorigin href="./static/vendor-BS4xPthR.js">
-      <link rel="stylesheet" crossorigin href="./static/vendor-Cg3S-P9H.css">
-      <link rel="stylesheet" crossorigin href="./static/index-DhPPoJ7G.css">
+      <script type="module" crossorigin src="./static/index-DahGi9MJ.js"></script>
+      <link rel="modulepreload" crossorigin href="./static/vendor-C-LZL3XS.js">
+      <link rel="stylesheet" crossorigin href="./static/index-CA__xCpW.css">
     </head>
     <body>
         <div id="mitmproxy"></div>

pyproject.toml

@@ -38,23 +38,27 @@ dependencies = [
     "bcrypt>=5.0.0,<=5.0.0",
     "Brotli>=1.0,<=1.2.0",
     "certifi>=2019.9.11",  # no upper bound here to get latest CA bundle
-    "cryptography>=42.0,<=50.0.0",  # relaxed upper bound here to get security fixes
-    "flask>=3.0,<=3.1.3",
+    "cryptography>=50.0.1,<=50.0.1",  # includes the current OpenSSL security fixes
+    "flask>=3.1.3,<=3.1.3",
     "h11>=0.16.0,<=0.16.0",
-    "h2>=4.3.0,<=4.4.1",
+    "h2>=4.4.1,<=4.4.1",
+    "hpack>=4.2.0,<5",  # bound malformed HTTP/2 integer decoding
     "hyperframe>=6.0,<=6.1.0",
+    "idna>=3.15,<4",
     "kaitaistruct>=0.10,<=0.11",
     "ldap3>=2.8,<=2.9.1",
+    "pyasn1>=0.6.4,<0.7",  # security floor for ldap3's ASN.1 decoder
     "mitmproxy_rs>=0.12.6,<0.13",  # relaxed upper bound here: we control this
     "pydivert>=2.0.3,<=3.1.3; sys_platform == 'win32'",
     "pyOpenSSL>=24.3,<=27.0.0",
     "pyparsing>=3.3.2,<=3.3.2",
     "pyperclip>=1.9.0,<=1.11.0",
     "ruamel.yaml>=0.18.10,<=0.19.1",
     "sortedcontainers>=2.3,<=2.4.0",
-    "tornado>=6.5.0,<=6.5.8",
+    "tornado>=6.5.10,<=6.5.10",
     "typing-extensions>=4.13.2,<=4.14; python_version < '3.13'",
     "urwid>=2.6.14,<=4.0.9",
+    "werkzeug>=3.1.6,<4",  # reject Windows device names in map-local paths
     "wsproto>=1.0,<=1.3.2",
     "publicsuffix2>=2.20190812,<=2.20191221",
 ]
@@ -65,14 +69,17 @@ dev = [
     "hypothesis==6.130.6",
     "maturin==1.14.1",
     "pdoc==16.0.0",
+    "pygments>=2.20.0,<3",
     "pyinstaller==6.22.0",
     "pyinstaller-hooks-contrib==2026.6",
     "pytest-asyncio==1.2.0",
     "pytest-cov==7.0.0",
     "pytest-timeout==2.4.0",
     "pytest-xdist==3.8.0",
     "pytest==8.4.2",
+    "setuptools>=83.0.0",
     "requests==2.34.2",
+    "urllib3>=2.7.0,<3",  # bounded decompression in HTTP clients
     "wheel==0.48.0",
     "build==1.5.0",
     "mypy==1.20.2",
@@ -81,15 +88,18 @@ dev = [
     {include-group = "ruff"},
 ]
 tox = [
+    "uv>=0.11.15,<1",
     "tox==4.55.1",
     "tox-uv==1.35.2",
 ]
 ruff = [
     "ruff==0.16.3",
 ]
 deploy = [
+    "pygments>=2.20.0,<3",
     "awscli==1.46.0",
     "twine==7.0.0",
+    "urllib3>=2.7.0,<3",
 ]
 
 [project.urls]
@@ -107,7 +117,7 @@ mitmweb = "mitmproxy.tools.main:mitmweb"
 hook-dirs = "mitmproxy.utils.pyinstaller:hook_dirs"
 
 [build-system]
-requires = ["setuptools"]
+requires = ["setuptools>=83.0.0"]
 build-backend = "setuptools.build_meta"
 
 [tool.setuptools.dynamic]