| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Clears eight open Dependabot alerts. None were exploitable against this
service as written -- it exposes no form endpoints, mounts no StaticFiles,
never reads request.url, sets no secrets_dir, and runs on Linux while
several of the advisories are Windows-only -- but the bumps are cheap and
that analysis only holds until the surface changes.
starlette 1.0.0 -> 1.3.1 resolves five advisories on its own and requires
fastapi 0.135.3 -> 0.139.2 to satisfy its pin. Mako is a transitive
alembic dependency used only to scaffold migrations.
pytest is left at 8.4.2; its advisory is test-only and the fix would need
the <9.0 constraint in pyproject.toml relaxed across a major version.
|
