fix: raise the two new dependency floors past their CVEs, silence a deliberate re-export

All three of these were introduced by this PR, which is what makes them
worth fixing here rather than deferring.

`urllib3` and `jinja2` were added to the requirements so that direct
imports stop relying on transitives — right call, but both floors were
set to the version that introduced the API rather than a version that is
safe to install. `urllib3>=1.26.0` sits below roughly ten CVEs including
a decompression-bomb safeguard bypass, and `jinja2>=3.1.0` below five
including two sandbox breakouts. Raised to 2.7.0 and 3.1.6, which is what
a working device already runs, so no install is disturbed. The comments
now say the floor is a security floor, since the next person to read
"imported directly" would otherwise reasonably lower it again.

This is the same reasoning the PR already applied to werkzeug; these two
just missed it.

The `DateTimeEncoder` import in cache_manager is unused on purpose — the
canonical class moved to src.cache.disk_cache and this re-export keeps
the documented import path working. flake8 cannot see intent, so it gets
an explicit `# noqa: F401` rather than being removed and quietly breaking
anything importing it from here. Verified the re-export still resolves to
the same object and still serialises datetimes.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Udr6MfaFLUPhX5Fgo67Jf5

Author: ChuckBuilds

requirements.txt

@@ -11,7 +11,7 @@ pytz>=2024.2,<2025.0  # Updated for latest timezone data
 
 # HTTP requests
 requests>=2.33.0,<3.0.0
-urllib3>=1.26.0,<3.0.0  # requests transitive, but imported directly (urllib3.util.retry.Retry)
+urllib3>=2.7.0,<3.0.0  # requests transitive, but imported directly (urllib3.util.retry.Retry); floor is a security floor, not the API floor — 1.26.x carries ~10 CVEs
 
 # Google API integration
 

src/cache_manager.py

@@ -42,7 +42,7 @@
 # Canonical implementation lives in src.cache.disk_cache; re-exported here
 # because this module's docstring documents it and external code may import
 # it from either path.
-from src.cache.disk_cache import DateTimeEncoder
+from src.cache.disk_cache import DateTimeEncoder  # noqa: F401 - deliberate re-export
 
 class CacheManager:
     """Manages caching of API responses to reduce API calls."""

web_interface/requirements.txt

@@ -7,7 +7,7 @@ flask>=3.1.3,<4.0.0
 werkzeug>=3.1.6,<4.0.0  # Flask transitive; pinned to keep a security floor above Flask's own >=3.1.0
 flask-limiter>=3.5.0,<4.0.0  # Rate limiting (prevent accidental abuse)
 flask-compress>=1.14  # gzip/brotli response compression (big win for the large JS/HTML over WiFi)
-jinja2>=3.1.0,<4.0.0  # Flask transitive, but imported directly (TemplateNotFound)
+jinja2>=3.1.6,<4.0.0  # Flask transitive, but imported directly (TemplateNotFound); 3.1.6 is the security floor — earlier 3.1.x has sandbox breakouts
 markupsafe>=2.1.0,<4.0.0  # Flask transitive, but imported directly (escape)
 
 # WebSocket support: intentionally NOT declared here. The web interface