hutch-stats.git/uv.lock, branch dependabot/uv/alembic-1.18.5

chore(deps): bump alembic from 1.18.4 to 1.18.5

2026-07-27T09:36:56+00:00

Bumps [alembic](https://github.com/sqlalchemy/alembic) from 1.18.4 to 1.18.5. - [Release notes](https://github.com/sqlalchemy/alembic/releases) - [Changelog](https://github.com/sqlalchemy/alembic/blob/main/CHANGES) - [Commits](https://github.com/sqlalchemy/alembic/commits) --- updated-dependencies: - dependency-name: alembic dependency-version: 1.18.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot]

Merge pull request #5 from zerolabsco/dependabot/uv/pydantic-2.13.4

2026-07-20T17:17:54+00:00

chore(deps): bump pydantic from 2.12.5 to 2.13.4

Merge pull request #1 from zerolabsco/dependabot/uv/apscheduler-3.11.3

2026-07-20T17:16:42+00:00

chore(deps): bump apscheduler from 3.11.2 to 3.11.3

chore(deps): allow pytest 9 and upgrade to 9.1.1

2026-07-20T17:13:25+00:00

Closes CVE-2025-71176 (tmpdir handling). Test-only dependency, never in the runtime image. Floor raised to 9.0.3 rather than just dropping the <9.0 ceiling: with the floor left at 8.2 a fresh resolve could still land on a vulnerable 8.x and the advisory would stay open.

chore(deps): bump pydantic from 2.12.5 to 2.13.4

2026-07-20T17:04:53+00:00

Bumps [pydantic](https://github.com/pydantic/pydantic) from 2.12.5 to 2.13.4. - [Release notes](https://github.com/pydantic/pydantic/releases) - [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md) - [Commits](https://github.com/pydantic/pydantic/compare/v2.12.5...v2.13.4) --- updated-dependencies: - dependency-name: pydantic dependency-version: 2.13.4 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot]

chore(deps): upgrade starlette, mako, idna and pydantic-settings

2026-07-20T16:59:47+00:00

Clears eight open Dependabot alerts. None were exploitable against this service as written -- it exposes no form endpoints, mounts no StaticFiles, never reads request.url, sets no secrets_dir, and runs on Linux while several of the advisories are Windows-only -- but the bumps are cheap and that analysis only holds until the surface changes. starlette 1.0.0 -> 1.3.1 resolves five advisories on its own and requires fastapi 0.135.3 -> 0.139.2 to satisfy its pin. Mako is a transitive alembic dependency used only to scaffold migrations. pytest is left at 8.4.2; its advisory is test-only and the fix would need the <9.0 constraint in pyproject.toml relaxed across a major version.

chore(deps): bump apscheduler from 3.11.2 to 3.11.3

2026-07-20T16:46:36+00:00

Bumps [apscheduler](https://github.com/agronholm/apscheduler) from 3.11.2 to 3.11.3. - [Release notes](https://github.com/agronholm/apscheduler/releases) - [Commits](https://github.com/agronholm/apscheduler/compare/3.11.2...3.11.3) --- updated-dependencies: - dependency-name: apscheduler dependency-version: 3.11.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot]

fix: reduce sr.ht poll API load with cached repo discovery

2026-04-12T02:32:49+00:00