Classic298
18d004cabe
The migration to joserfc completed the job but left the old dependency pinned. `python-jose` now has zero imports anywhere in the backend: the only `jose` references left are `joserfc` in `utils/oauth.py`, and a repo-wide search for `from jose`, `import jose` or `python_jose` returns nothing outside the three pin files. Removing it also removes `ecdsa` and `rsa` from the image, which were pulled in only by python-jose. `uv lock` confirms that: it drops exactly those three packages and nothing else, because google-auth 2.55 depends on cryptography and pyasn1-modules rather than rsa. That is worth having beyond the size saving, since `ecdsa` ships a documented Minerva-style timing side-channel in its P-256 signing path that upstream has declined to fix, so keeping it in the image means shipping a flagged crypto library that nothing calls. Verified by blocking the `jose` module at import time and importing the backend anyway: ``` PASS import open_webui.utils.auth PASS import open_webui.utils.oauth PASS import open_webui.main jose in sys.modules: False PASS create_token/decode_token round trip ``` One user-visible consequence worth stating: Tools and Functions run in the same interpreter, so a third-party plugin that imports `jose` directly stops working after this. Nothing in Open WebUI itself does, and PyJWT remains a dependency, but a plugin relying on a library the application never declared for that purpose is the only thing this can break. `uv.lock` was edited surgically rather than regenerated, to avoid the unrelated whole-file churn a newer uv version introduces. The result was diffed against real `uv lock` output and matches it exactly apart from that version's cosmetic fields.
59 lines
960 B
Plaintext
59 lines
960 B
Plaintext
# Minimal requirements for backend to run
|
|
# WIP: use this as a reference to build a minimal docker image
|
|
|
|
fastapi==0.136.3
|
|
uvicorn[standard]==0.51.0
|
|
pydantic==2.13.4
|
|
python-multipart==0.0.32
|
|
itsdangerous==2.2.0
|
|
|
|
python-socketio==5.16.2
|
|
cryptography
|
|
bcrypt==5.0.0
|
|
argon2-cffi==25.1.0
|
|
PyJWT[crypto]==2.13.0
|
|
authlib==1.7.2
|
|
joserfc==1.7.4
|
|
|
|
requests==2.34.2
|
|
aiohttp==3.13.5 # do not update to 3.13.3 - broken
|
|
async-timeout
|
|
aiocache
|
|
aiofiles
|
|
starlette-compress==1.7.1
|
|
Brotli==1.2.0
|
|
brotlicffi==1.2.0.1
|
|
httpx[socks,http2,zstd,cli,brotli]==0.28.1
|
|
starsessions[redis]==2.2.1
|
|
|
|
sqlalchemy==2.0.50
|
|
aiosqlite==0.22.1
|
|
psycopg[binary]==3.3.4
|
|
alembic==1.18.4
|
|
|
|
pycrdt==0.13.1
|
|
redis
|
|
hiredis
|
|
|
|
APScheduler==3.11.2
|
|
RestrictedPython==8.2
|
|
|
|
loguru==0.7.3
|
|
asgiref==3.11.1
|
|
|
|
mcp==1.27.2
|
|
openai
|
|
|
|
langchain==1.2.10
|
|
langchain-community==0.4.2
|
|
langchain-classic==1.0.7
|
|
langchain-text-splitters==1.1.2
|
|
|
|
fake-useragent==2.2.0
|
|
|
|
chromadb==1.5.9
|
|
black==26.5.1
|
|
pydub
|
|
chardet==7.4.3
|
|
beautifulsoup4
|