requests 2.32.3 is still pinned and affected by CVE-2024-47081

Hi, I noticed that the current dependency set still pins an affected requests version.

requirements.txt currently has:

requests==2.32.3

GHSA-9hjg-9r4m-mvj7 / CVE-2024-47081 affects requests < 2.32.4, so installs from the current requirements file can still use the affected version.

Impact

A crafted URL with userinfo can cause .netrc credentials for the apparent host to be sent to the actual destination controlled by an attacker.

In local validation, the CLI startup path imported core.llm.base, which calls tiktoken.get_encoding("cl100k_base"). That path caused tiktoken to fetch encoder data through the vulnerable requests version. With a crafted URL, a local attacker server received an Authorization header for the .netrc host. The captured credential is redacted below.

[VERIFY] triggered (class=netrc_userinfo_leak): /tmp/attacker.log: Authorization: [REDACTED]

Current evidence

• Current repository HEAD checked: 9b763fdaf0020c7d8abacc7b58b2b09e57494623
• Current dependency pin: requirements.txt has requests==2.32.3
• Relevant startup path: main.py -> core.cli.main -> core.agents.orchestrator -> core.agents.architect -> core.agents.base -> core.llm.base
• Advisory fixed version: requests>=2.32.4
• Local validation reached the gpt-pilot CLI path and confirmed the netrc credential leak with redacted Authorization-header evidence.

Suggested fix

Update the requirements file to use requests>=2.32.4, or regenerate the pinned dependency set with a patched requests version.

Thanks.