From 011dea8eb7cc7e18316d5299acd951850422947d Mon Sep 17 00:00:00 2001 From: npeter83 Date: Tue, 27 Oct 2026 21:46:16 +0100 Subject: [PATCH] fix(deps): Authlib 1.7.2 -> 1.9.1 for CVE-2026-96760 and CVE-2026-114616 One pin bumped in place; pip check passes and pip-audit finds nothing. --- backend/requirements.lock | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/backend/requirements.lock b/backend/requirements.lock index 487b8557..c1150acc 100644 --- a/backend/requirements.lock +++ b/backend/requirements.lock @@ -6,9 +6,10 @@ # bumped in place instead of a full regeneration, which would move every other package too — then # `pip install -r requirements.lock && pip check` must pass. In place so far: urllib3 2.7.0 -> 2.8.0 (PYSEC-2026-4175/4176/4177); yt-dlp 2026.7.4 -> 2026.8.19 # (it marks the clients that need a stream PO token, so the downloader stops fetching into a 403); -# certifi 2026.7.22 -> 2026.10.19 (GHSA-6q48-6c7w-9gw2); brotli 1.2.0 -> 1.2.1 (PYSEC-2026-4322). +# certifi 2026.7.22 -> 2026.10.19 (GHSA-6q48-6c7w-9gw2); brotli 1.2.0 -> 1.2.1 (PYSEC-2026-4322); +# Authlib 1.7.2 -> 1.9.1 (CVE-2026-96760, CVE-2026-114616). APScheduler==3.11.3 -Authlib==1.7.2 +Authlib==1.9.1 Mako==1.4.1 MarkupSafe==3.0.3 PyYAML==6.0.3