revel-backend

v1.71.1 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 11d Productivity & Wikis

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 2 known CVEs

Affected surfaces

crypto_tls deps

ReleasePort's take

Moderate signal

editorial:auto 11d

The release upgrades anyio from 4.9.0 to 4.14.2, fixing TLS certificate spoofing (GHSA-82r6-8w77-94w6) and a worker deadlock (GHSA-5p39-cfhj-2xmp).

Why it matters: Addresses two high‑severity GitHub Security Advisories—TLS spoofing (CVSS ≈ 9.0) and worker deadlock—by upgrading anyio to version 4.14.2; deployments using anyio via httpx or openai must update.

Summary

AI summary

Upgraded anyio to 4.14.2 to patch TLS certificate spoofing (GHSA-82r6-8w77-94w6) and worker deadlock (GHSA-5p39-cfhj-2xmp).

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Upgraded anyio from 4.9.0 to 4.14.2 to patch GHSA-82r6-8w77-94w6 and GHSA-5p39-cfhj-2xmp. Upgraded anyio from 4.9.0 to 4.14.2 to patch GHSA-82r6-8w77-94w6 and GHSA-5p39-cfhj-2xmp. Source: llm_adapter@2026-07-15 Confidence: high	—

Full changelog

Security

Upgraded anyio 4.9.0 → 4.14.2 (transitive via httpx/openai) to patch GHSA-82r6-8w77-94w6 (TLS certificate spoofing via IDNA 2003 host-name matching) and GHSA-5p39-cfhj-2xmp (process-pool workers blocking indefinitely on undrained stderr).

What's Changed

fix(deps): pin anyio>=4.14.2 to patch GHSA-82r6-8w77-94w6 and GHSA-5p39-cfhj-2xmp by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/705
chore(release): v1.71.1 by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/706

Full Changelog: https://github.com/letsrevel/revel-backend/compare/v1.71.0...v1.71.1

Security Fixes

dep: GHSA-82r6-8w77-94w6 — TLS certificate spoofing via IDNA 2003 host-name matching
dep: GHSA-5p39-cfhj-2xmp — process‑pool workers blocking indefinitely on undrained stderr

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track revel-backend

Get notified when new releases ship.

About revel-backend

The Django backend of the Revel event platform project

All releases →

Related context

Related tools

Earlier breaking changes

v1.72.1 Makes payment base fields (`amount`, `currency`, `platform_fee`) read-only
v1.72.1 Restricts organization ownership transfer to superusers only
v1.71.0 Checkout flow now uses a two-step reserve then session creation process.
v1.68.0 check-in endpoint path renamed to use ticket code (UUID or series:<uuid>) instead of ticket ID.