Cogniware OPEA Inventory Management Solution Example

[cogniware-devops]

Description

The summary of the proposed changes as long as the relevant motivation and context.

Cogniware Inc. is adding a new submodule for Inventory Management Solution Example built using CogniDREAM software platform

Issues

n/a

Type of change

List the type of change like below. Please delete options that are not relevant.

• New feature (non-breaking change which adds new functionality)

Dependencies

Web Framework

fastapi==0.104.1
uvicorn[standard]==0.24.0
python-multipart==0.0.6

Security

python-jose[cryptography]==3.3.0
passlib[bcrypt]==1.7.4
bcrypt==4.1.1
cryptography==41.0.7

Database

sqlalchemy==2.0.23
psycopg2-binary==2.9.9
alembic==1.12.1

Redis & Caching

redis==5.0.1
hiredis==2.2.3

HTTP Client

httpx==0.25.2
aiohttp==3.9.1

Data Processing

pandas==2.1.3
numpy==1.26.2
openpyxl==3.1.2
PyPDF2==3.0.1
python-docx==1.1.0

Validation

pydantic==2.5.2
pydantic-settings==2.1.0
email-validator==2.1.0

Utilities

python-dotenv==1.0.0
PyYAML==6.0.1

Logging & Monitoring

python-json-logger==2.0.7

AI/ML Libraries (for local processing)

scikit-learn==1.3.2

Testing (dev dependencies)

pytest==7.4.3
pytest-asyncio==0.21.1
pytest-cov==4.1.0
httpx-mock==0.11.0

Code Quality (dev dependencies)

black==23.11.0
flake8==6.1.0
mypy==1.7.1

Tests

Describe the tests that you ran to verify your changes.

[github-actions]

Dependency Review

The following issues were found:

• ❌ 7 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 2 package(s) with unknown licenses.

See the Details below.

Vulnerabilities

cogniware-opea-ims/backend/requirements.txt

Name	Version	Vulnerability	Severity
python-jose	3.3.0	python-jose algorithm confusion with OpenSSH ECDSA keys	critical
		python-jose denial of service via compressed JWE content	moderate
aiohttp	3.9.1	aiohttp is vulnerable to directory traversal	high
		aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests	high
		aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators	moderate
		aiohttp Cross-site Scripting vulnerability on index pages for static file handling	moderate
		aiohttp allows request smuggling due to incorrect parsing of chunk extensions	moderate
		AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections	low
cryptography	41.0.7	Python Cryptography package vulnerable to Bleichenbacher timing oracle attack	high
		cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override	high
		Null pointer dereference in PKCS12 parsing	moderate
		pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels	moderate
python-multipart	0.0.6	python-multipart vulnerable to Content-Type Header ReDoS	high
		Denial of service (DoS) via deformation `multipart/form-data` boundary	high
PyPDF2	3.0.1	pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a character	moderate
black	23.11.0	Black vulnerable to Regular Expression Denial of Service (ReDoS)	moderate
scikit-learn	1.3.2	scikit-learn sensitive data leakage vulnerability	moderate

License Issues

cogniware-opea-ims/backend/requirements.txt

Package	Version	License	Issue Type
httpx-mock	0.11.0	Null	Unknown License
PyPDF2	3.0.1	Null	Unknown License

Scanned Files

• cogniware-opea-ims/backend/requirements.txt

[joshuayao]

Hi @cogniware-devops Thanks for contributing this PR. Please provide a separate download link for the data files instead of including all the data directly in the GitHub repository.

[chensuyue]

Dependency Review

The following issues were found:

• ❌ 7 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 2 package(s) with unknown licenses.

Please at least resolve the critical and high CVEs.

[cogniware-devops]

Any recommendations on the specific versions for those third-party / open source packages that we should use?

…

On Mon, Oct 13, 2025 at 8:57 PM chen, suyue ***@***.***> wrote: *chensuyue* left a comment (opea-project/GenAIExamples#2307) <#2307 (comment)> Dependency Review The following issues were found: - ❌ 7 vulnerable package(s) - ✅ 0 package(s) with incompatible licenses - ✅ 0 package(s) with invalid SPDX license definitions - ⚠️ 2 package(s) with unknown licenses. Please at least resolve the critical and high CVEs. — Reply to this email directly, view it on GitHub <#2307 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BYIET5GARTFQEB2GI2M7V7D3XRDAJAVCNFSM6AAAAACJBJUQ5CVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTGOJZGU3TGMRTGI> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[joshuayao]

ecommendations on the specific versions for those third-party / open source packages that we should use?

Hi @cogniware-devops Please review the table at #2307 (comment). The links in the Vulnerability column provide the corresponding solutions.