From 2b34a2a2c39fc6a57c91cc9115aff57dda6ac5cf Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 4 Oct 2026 18:25:47 +0000 Subject: [PATCH] Bump the backend-python group across 1 directory with 30 updates Bumps the backend-python group with 30 updates in the /backend directory: | Package | From | To | | --- | --- | --- | | [fastapi](https://github.com/fastapi/fastapi) | `0.141.1` | `0.142.2` | | [starlette](https://github.com/Kludex/starlette) | `1.6.0` | `1.7.0` | | [uvicorn](https://github.com/Kludex/uvicorn) | `0.30.6` | `0.54.0` | | [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.0.35` | `2.1.1` | | [asyncpg](https://github.com/MagicStack/asyncpg) | `0.29.0` | `0.31.0` | | [psycopg2-binary](https://github.com/psycopg/psycopg2) | `2.9.9` | `2.9.13` | | [alembic](https://github.com/sqlalchemy/alembic) | `1.13.2` | `1.20.0` | | [pydantic](https://github.com/pydantic/pydantic) | `2.9.2` | `2.13.5` | | [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.5.2` | `2.15.0` | | [email-validator](https://github.com/JoshData/python-email-validator) | `2.2.0` | `2.3.0` | | [pyjwt](https://github.com/jpadilla/pyjwt) | `2.14.0` | `2.15.1` | | [cryptography](https://github.com/pyca/cryptography) | `50.0.1` | `50.0.2` | | [httpx](https://github.com/encode/httpx) | `0.27.2` | `0.28.1` | | [aiodns](https://github.com/aio-libs/aiodns) | `3.2.0` | `3.6.1` | | [pycares](https://github.com/saghul/pycares) | `4.9.0` | `4.11.0` | | [celery](https://github.com/celery/celery) | `5.4.0` | `5.6.3` | | [redis](https://github.com/redis/redis-py) | `5.0.8` | `5.3.1` | | [msgpack](https://github.com/msgpack/msgpack-python) | `1.2.1` | `1.2.3` | | [fpdf2](https://github.com/py-pdf/fpdf2) | `2.8.1` | `2.8.9` | | [python-whois](https://github.com/richardpenman/whois) | `0.9.4` | `0.9.6` | | [dnspython](https://github.com/rthalley/dnspython) | `2.6.1` | `2.8.0` | | [typer](https://github.com/fastapi/typer) | `0.12.5` | `0.27.2` | | [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.2.2` | `1.2.4` | | [tenacity](https://github.com/jd/tenacity) | `9.0.0` | `9.1.4` | | [pytest](https://github.com/pytest-dev/pytest) | `9.0.3` | `9.1.1` | | [pytest-asyncio](https://github.com/pytest-dev/pytest-asyncio) | `1.3.0` | `1.4.0` | | [anyio](https://github.com/agronholm/anyio) | `4.14.2` | `4.15.1` | | [aiosqlite](https://github.com/omnilib/aiosqlite) | `0.20.0` | `0.22.1` | | [ruff](https://github.com/astral-sh/ruff) | `0.6.5` | `0.16.10` | | [mypy](https://github.com/python/mypy) | `1.11.2` | `1.20.2` | Updates `fastapi` from 0.141.1 to 0.142.2 - [Release notes](https://github.com/fastapi/fastapi/releases) - [Commits](https://github.com/fastapi/fastapi/compare/0.141.1...0.142.2) Updates `starlette` from 1.6.0 to 1.7.0 - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](https://github.com/Kludex/starlette/compare/1.6.0...1.7.0) Updates `uvicorn` from 0.30.6 to 0.54.0 - [Release notes](https://github.com/Kludex/uvicorn/releases) - [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md) - [Commits](https://github.com/Kludex/uvicorn/compare/0.30.6...0.54.0) Updates `sqlalchemy` from 2.0.35 to 2.1.1 - [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases) - [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst) - [Commits](https://github.com/sqlalchemy/sqlalchemy/commits) Updates `asyncpg` from 0.29.0 to 0.31.0 - [Release notes](https://github.com/MagicStack/asyncpg/releases) - [Commits](https://github.com/MagicStack/asyncpg/compare/v0.29.0...v0.31.0) Updates `psycopg2-binary` from 2.9.9 to 2.9.13 - [Changelog](https://github.com/psycopg/psycopg2/blob/master/NEWS) - [Commits](https://github.com/psycopg/psycopg2/compare/2.9.9...2.9.13) Updates `alembic` from 1.13.2 to 1.20.0 - [Release notes](https://github.com/sqlalchemy/alembic/releases) - [Changelog](https://github.com/sqlalchemy/alembic/blob/main/CHANGES) - [Commits](https://github.com/sqlalchemy/alembic/commits) Updates `pydantic` from 2.9.2 to 2.13.5 - [Release notes](https://github.com/pydantic/pydantic/releases) - [Changelog](https://github.com/pydantic/pydantic/blob/v2.13.5/HISTORY.md) - [Commits](https://github.com/pydantic/pydantic/compare/v2.9.2...v2.13.5) Updates `pydantic-settings` from 2.5.2 to 2.15.0 - [Release notes](https://github.com/pydantic/pydantic-settings/releases) - [Commits](https://github.com/pydantic/pydantic-settings/compare/v2.5.2...v2.15.0) Updates `email-validator` from 2.2.0 to 2.3.0 - [Release notes](https://github.com/JoshData/python-email-validator/releases) - [Changelog](https://github.com/JoshData/python-email-validator/blob/main/CHANGELOG.md) - [Commits](https://github.com/JoshData/python-email-validator/compare/v2.2.0...v2.3.0) Updates `pyjwt` from 2.14.0 to 2.15.1 - [Release notes](https://github.com/jpadilla/pyjwt/releases) - [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst) - [Commits](https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.1) Updates `cryptography` from 50.0.1 to 50.0.2 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](https://github.com/pyca/cryptography/compare/50.0.1...50.0.2) Updates `httpx` from 0.27.2 to 0.28.1 - [Release notes](https://github.com/encode/httpx/releases) - [Changelog](https://github.com/encode/httpx/blob/master/CHANGELOG.md) - [Commits](https://github.com/encode/httpx/compare/0.27.2...0.28.1) Updates `aiodns` from 3.2.0 to 3.6.1 - [Release notes](https://github.com/aio-libs/aiodns/releases) - [Changelog](https://github.com/aio-libs/aiodns/blob/master/ChangeLog) - [Commits](https://github.com/aio-libs/aiodns/compare/v3.2.0...v3.6.1) Updates `pycares` from 4.9.0 to 4.11.0 - [Release notes](https://github.com/saghul/pycares/releases) - [Changelog](https://github.com/saghul/pycares/blob/master/ChangeLog) - [Commits](https://github.com/saghul/pycares/compare/v4.9.0...v4.11.0) Updates `celery` from 5.4.0 to 5.6.3 - [Release notes](https://github.com/celery/celery/releases) - [Changelog](https://github.com/celery/celery/blob/main/Changelog.rst) - [Commits](https://github.com/celery/celery/compare/v5.4.0...v5.6.3) Updates `redis` from 5.0.8 to 5.3.1 - [Release notes](https://github.com/redis/redis-py/releases) - [Changelog](https://github.com/redis/redis-py/blob/master/CHANGES) - [Commits](https://github.com/redis/redis-py/compare/v5.0.8...v5.3.1) Updates `msgpack` from 1.2.1 to 1.2.3 - [Release notes](https://github.com/msgpack/msgpack-python/releases) - [Changelog](https://github.com/msgpack/msgpack-python/blob/main/CHANGELOG.md) - [Commits](https://github.com/msgpack/msgpack-python/compare/v1.2.1...v1.2.3) Updates `fpdf2` from 2.8.1 to 2.8.9 - [Release notes](https://github.com/py-pdf/fpdf2/releases) - [Changelog](https://github.com/py-pdf/fpdf2/blob/master/CHANGELOG.md) - [Commits](https://github.com/py-pdf/fpdf2/compare/2.8.1...2.8.9) Updates `python-whois` from 0.9.4 to 0.9.6 - [Commits](https://github.com/richardpenman/whois/commits) Updates `dnspython` from 2.6.1 to 2.8.0 - [Release notes](https://github.com/rthalley/dnspython/releases) - [Changelog](https://github.com/rthalley/dnspython/blob/main/doc/whatsnew.rst) - [Commits](https://github.com/rthalley/dnspython/compare/v2.6.1...v2.8.0) Updates `typer` from 0.12.5 to 0.27.2 - [Release notes](https://github.com/fastapi/typer/releases) - [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md) - [Commits](https://github.com/fastapi/typer/compare/0.12.5...0.27.2) Updates `python-dotenv` from 1.2.2 to 1.2.4 - [Release notes](https://github.com/theskumar/python-dotenv/releases) - [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md) - [Commits](https://github.com/theskumar/python-dotenv/compare/v1.2.2...v1.2.4) Updates `tenacity` from 9.0.0 to 9.1.4 - [Release notes](https://github.com/jd/tenacity/releases) - [Commits](https://github.com/jd/tenacity/compare/9.0.0...9.1.4) Updates `pytest` from 9.0.3 to 9.1.1 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](https://github.com/pytest-dev/pytest/compare/9.0.3...9.1.1) Updates `pytest-asyncio` from 1.3.0 to 1.4.0 - [Release notes](https://github.com/pytest-dev/pytest-asyncio/releases) - [Commits](https://github.com/pytest-dev/pytest-asyncio/compare/v1.3.0...v1.4.0) Updates `anyio` from 4.14.2 to 4.15.1 - [Release notes](https://github.com/agronholm/anyio/releases) - [Commits](https://github.com/agronholm/anyio/compare/4.14.2...4.15.1) Updates `aiosqlite` from 0.20.0 to 0.22.1 - [Changelog](https://github.com/omnilib/aiosqlite/blob/main/CHANGELOG.md) - [Commits](https://github.com/omnilib/aiosqlite/compare/v0.20.0...v0.22.1) Updates `ruff` from 0.6.5 to 0.16.10 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](https://github.com/astral-sh/ruff/compare/0.6.5...0.16.10) Updates `mypy` from 1.11.2 to 1.20.2 - [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md) - [Commits](https://github.com/python/mypy/compare/v1.11.2...v1.20.2) --- updated-dependencies: - dependency-name: fastapi dependency-version: 0.142.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-python - dependency-name: starlette dependency-version: 1.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-python - dependency-name: uvicorn dependency-version: 0.54.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-python - dependency-name: sqlalchemy dependency-version: 2.1.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-python - dependency-name: asyncpg dependency-version: 0.31.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-python - dependency-name: psycopg2-binary dependency-version: 2.9.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend-python - dependency-name: alembic dependency-version: 1.20.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-python - dependency-name: pydantic dependency-version: 2.13.5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-python - dependency-name: pydantic-settings dependency-version: 2.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-python - dependency-name: email-validator dependency-version: 2.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-python - dependency-name: pyjwt dependency-version: 2.15.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-python - dependency-name: cryptography dependency-version: 50.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend-python - dependency-name: httpx dependency-version: 0.28.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-python - dependency-name: aiodns dependency-version: 3.6.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-python - dependency-name: pycares dependency-version: 4.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-python - dependency-name: celery dependency-version: 5.6.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-python - dependency-name: redis dependency-version: 5.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-python - dependency-name: msgpack dependency-version: 1.2.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend-python - dependency-name: fpdf2 dependency-version: 2.8.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend-python - dependency-name: python-whois dependency-version: 0.9.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend-python - dependency-name: dnspython dependency-version: 2.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-python - dependency-name: typer dependency-version: 0.27.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-python - dependency-name: python-dotenv dependency-version: 1.2.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend-python - dependency-name: tenacity dependency-version: 9.1.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-python - dependency-name: pytest dependency-version: 9.1.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: backend-python - dependency-name: pytest-asyncio dependency-version: 1.4.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: backend-python - dependency-name: anyio dependency-version: 4.15.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: backend-python - dependency-name: aiosqlite dependency-version: 0.22.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: backend-python - dependency-name: ruff dependency-version: 0.16.10 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: backend-python - dependency-name: mypy dependency-version: 1.20.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: backend-python ... Signed-off-by: dependabot[bot] --- backend/requirements-dev.txt | 12 ++++----- backend/requirements.txt | 48 ++++++++++++++++++------------------ 2 files changed, 30 insertions(+), 30 deletions(-) diff --git a/backend/requirements-dev.txt b/backend/requirements-dev.txt index 65ebce1..9752340 100644 --- a/backend/requirements-dev.txt +++ b/backend/requirements-dev.txt @@ -13,8 +13,8 @@ # 8.3.2 is reported by pip-audit under PYSEC-2026-1845 / GHSA-6w46-j5rx-g56g # (fixed in 9.0.3), which is why the runner moved to 9 together with the # pytest-asyncio 1.x line it requires. -pytest==9.0.3 -pytest-asyncio==1.3.0 +pytest==9.1.1 +pytest-asyncio==1.4.0 # pytest-httpx used to sit here and is deliberately gone: no test used it (the # suite mocks HTTP through httpx.MockTransport and ASGITransport directly), and # every release that supports pytest 9 also demands httpx==0.28.* — a runtime @@ -22,9 +22,9 @@ pytest-asyncio==1.3.0 pytest-cov==7.1.0 # 4.6.2.post1 is affected by GHSA-82r6-8w77-94w6 (critical, TLS hostname # spoofing via IDNA 2003) and GHSA-5p39-cfhj-2xmp; both fixed in 4.14.2. -anyio==4.14.2 -aiosqlite==0.20.0 +anyio==4.15.1 +aiosqlite==0.22.1 # --- Static analysis --------------------------------------------------------- -ruff==0.6.5 -mypy==1.11.2 +ruff==0.16.10 +mypy==1.20.2 diff --git a/backend/requirements.txt b/backend/requirements.txt index 7204f93..dd5fa1a 100644 --- a/backend/requirements.txt +++ b/backend/requirements.txt @@ -14,9 +14,9 @@ # before 1.3.1 carries fourteen advisories (PYSEC-2026-1941/1943/161/2280/2281/ # 248/249) that the security job flags on every push. Both are pinned exactly: # Starlette is a shipped runtime dependency even though it arrives transitively. -fastapi==0.141.1 -starlette==1.6.0 -uvicorn[standard]==0.30.6 +fastapi==0.142.2 +starlette==1.7.0 +uvicorn[standard]==0.54.0 # 0.0.9 is affected by CVE-2024-53981 (DoS) and by the 2026 path-traversal and # header-parsing issues fixed in 0.0.22. Reachable: the login endpoint parses # form data through this library. @@ -24,58 +24,58 @@ python-multipart==0.0.32 gunicorn==23.0.0 # --- Database ---------------------------------------------------------------- -sqlalchemy==2.0.35 -asyncpg==0.29.0 -psycopg2-binary==2.9.9 -alembic==1.13.2 +sqlalchemy==2.1.1 +asyncpg==0.31.0 +psycopg2-binary==2.9.13 +alembic==1.20.0 # --- Data Validation --------------------------------------------------------- -pydantic==2.9.2 -pydantic-settings==2.5.2 -email-validator==2.2.0 +pydantic==2.13.5 +pydantic-settings==2.15.0 +email-validator==2.3.0 # --- Security & Auth --------------------------------------------------------- # PyJWT replaced python-jose: 3.3.0 carries CVE-2024-33663 (algorithm confusion) # and CVE-2024-33664 (JWE decompression DoS), and a September 2026 advisory still # covers releases up to 3.5.0. passlib was dropped as well — it is unmaintained # and required a monkeypatch of a private hook to work with current bcrypt. -PyJWT[crypto]==2.14.0 +PyJWT[crypto]==2.15.1 bcrypt==5.0.0 -cryptography==50.0.1 +cryptography==50.0.2 qrcode==8.2 # --- HTTP Clients (async) ---------------------------------------------------- -httpx==0.27.2 -aiodns==3.2.0 +httpx==0.28.1 +aiodns==3.6.1 # 4.5.0 is affected by CVE-2025-48945. -pycares==4.9.0 +pycares==4.11.0 # --- Task Queue -------------------------------------------------------------- -celery[redis]==5.4.0 -redis==5.0.8 +celery[redis]==5.6.3 +redis==5.3.1 # msgpack is used by Kombu's serializer and must include the fix for # GHSA-6v7p-g79w-8964 (fixed in 1.2.1). -msgpack==1.2.1 +msgpack==1.2.3 # --- Templates & Rendering --------------------------------------------------- # 3.1.4 is affected by CVE-2024-56201 and CVE-2024-56326 (sandbox escape). jinja2==3.1.6 # --- PDF Generation ---------------------------------------------------------- -fpdf2==2.8.1 +fpdf2==2.8.9 # --- Threat Intelligence ----------------------------------------------------- mmh3==4.1.0 -python-whois==0.9.4 -dnspython==2.6.1 +python-whois==0.9.6 +dnspython==2.8.0 # --- CLI & Configuration ----------------------------------------------------- -typer==0.12.5 +typer==0.27.2 # 1.0.1 is affected by PYSEC-2026-2270. -python-dotenv==1.2.2 +python-dotenv==1.2.4 # --- Resilience -------------------------------------------------------------- -tenacity==9.0.0 +tenacity==9.1.4 # --- Structured Logging ------------------------------------------------------ structlog==24.4.0