The ".gitignore" rules "lib" and "lib64" (from the Python template, meant
for a virtualenv at the repository root) match a directory with that name
at any depth. They kept two folders of the bundled web UI out of git:
- assets/vnc-console/novnc/vendor/pako/lib/ (12 files, zlib for noVNC)
- assets/xpra-html5/js/lib/ (20 files)
Anything built from a git checkout (GitHub archives, Docker images) ships
without them. The server answers a missing asset with the web UI page, so
noVNC's module graph fails to load (a module served as text/html) and the
VNC console stays on "Initializing VNC Console..."; the xpra console loses
its scripts the same way.
Anchor both rules to the repository root and add the 32 files, taken from
gns3-web-ui v3.1.0a7 (the bundled version); every blob is identical to the
one in that tag. A test walks the VNC console's module imports and the xpra
pages' scripts and fails on any file that is not in the package.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(deps): upgrade pytest to 9.0.3 to fix CVE-2025-71176
CVE-2025-71176: pytest 9.0.2 and earlier versions have a local
security vulnerability due to predictable temporary directory naming.
- pytest: 8.4.2 → 9.0.3
- Python 3.10+ is now required
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(deps): upgrade python-multipart to 0.0.26 to fix CVE-2026-40347
CVE-2026-40347: python-multipart < 0.0.26 has a denial of
service vulnerability when parsing multipart data.
- python-multipart: 0.0.22 → 0.0.26
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(deps): upgrade swagger-ui to 4.1.3 to fix CVE-2018-25031
CVE-2018-25031: swagger-ui < 4.1.3 has a spoofing vulnerability
where remote attackers can display remote OpenAPI definitions
via crafted URLs.
- swagger-ui: 3.30.0 → 4.1.3
- Updated swagger-ui-bundle.js and swagger-ui.css
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(api): change FastAPI version from "v3" to "3.0.0" for Swagger UI 4.1.3 compatibility
Swagger UI 4.x enforces stricter version format validation.
The version "v3" is not accepted by the new validator.
Changed from:
- version="v3"
To:
- version="3.0.0"
This affects both controller and compute API definitions.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(deps): upgrade swagger-ui to 5.32.4
Fixes "Unable to render this definition" error when loading OpenAPI 3.0
docs. Swagger UI 3.x had incomplete OpenAPI 3.0 support.
- swagger-ui: 3.19.1 → 5.32.4 (latest)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
