Bump pyhanko from 0.36.2 to 0.37.0 in /backend

[dependabot]

Bumps pyhanko from 0.36.2 to 0.37.0.

Changelog

Sourced from pyhanko's changelog.

0.37.0

Release date: 2026-09-01

Breaking changes

• requests was relegated to the optional dependency group [requests] due to the change in default fetching backends (see below).

• Deprecate fallback to OS trust list through oscrypto.

• Remove long-standing deprecated APIs

  • Signer.sign, Signer.sign_prescribed_attributes, Signer.sign_general_data
  • validate_cms_signature, validate_detached_cms
  • PdfSigner.digest_doc_for_signing
  • open_pkcs11_session(token_label=...)
  • find_cms_attribute

• The HTTPTimeStamper reshuffle (see below) should not be a breaking change for most users, but code that relies on subclassing these objects will likely need some attention.

Dependency changes

• aiohttp was moved to the default dependency list. requests was relegated to the optional dependencies (see below). The [async-http] optional dependency group was kept around to avoid breaking dependency resolution downstream, but is now empty.

New features and enhancements

Validation ^^^^^^^^^^

• Let :class:~pyhanko.sign.validation.qualified.eutl_fetch.FileSystemTLCache accept a str path.

Miscellaneous ^^^^^^^^^^^^^

• Make aiohttp the default backend for fetching validation data and timestamp tokens

  • HTTPTimeStamper absorbs AIOHttpTimeStamper, which becomes a deprecated subclass.

... (truncated)

Commits

• 00362ec Joint release of all components
• 6305b22 Typo in doc label
• 5096214 Realign optional dep groups between libs
• bdd4c0e Merge remote-tracking branches 'origin/dependabot/uv/*'
• 3caabb9 Bump ruff from 0.16.4 to 0.16.5
• 8350d48 Bump click from 8.4.2 to 8.5.0
• 48c9c22 Bump platformdirs from 4.11.4 to 4.11.5
• f4bcf36 Merge remote-tracking branches 'origin/dependabot/*'
• a272e7f Bump github/codeql-action/init from 4.37.7 to 4.37.9
• b2145ee Bump github/codeql-action/autobuild from 4.37.7 to 4.37.9
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)