| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |\
| |
| | |
chore(deps): bump apscheduler from 3.11.2 to 3.11.3
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Bumps [apscheduler](https://github.com/agronholm/apscheduler) from 3.11.2 to 3.11.3.
- [Release notes](https://github.com/agronholm/apscheduler/releases)
- [Commits](https://github.com/agronholm/apscheduler/compare/3.11.2...3.11.3)
---
updated-dependencies:
- dependency-name: apscheduler
dependency-version: 3.11.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <[email protected]>
|
| | |
| |
| |
| |
| |
| |
| |
| |
| | |
Closes CVE-2025-71176 (tmpdir handling). Test-only dependency, never in
the runtime image.
Floor raised to 9.0.3 rather than just dropping the <9.0 ceiling: with the
floor left at 8.2 a fresh resolve could still land on a vulnerable 8.x and
the advisory would stay open.
|
| |/
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Clears eight open Dependabot alerts. None were exploitable against this
service as written -- it exposes no form endpoints, mounts no StaticFiles,
never reads request.url, sets no secrets_dir, and runs on Linux while
several of the advisories are Windows-only -- but the bumps are cheap and
that analysis only holds until the surface changes.
starlette 1.0.0 -> 1.3.1 resolves five advisories on its own and requires
fastapi 0.135.3 -> 0.139.2 to satisfy its pin. Mako is a transitive
alembic dependency used only to scaffold migrations.
pytest is left at 8.4.2; its advisory is test-only and the fix would need
the <9.0 constraint in pyproject.toml relaxed across a major version.
|
| |
|
