From 011dea8eb7cc7e18316d5299acd951850422947d Mon Sep 17 00:00:00 2001
From: npeter83 <npeter83+claude@gmail.com>
Date: Tue, 27 Oct 2026 21:46:16 +0100
Subject: [PATCH 1/2] fix(deps): Authlib 1.7.2 -> 1.9.1 for CVE-2026-96760 and
 CVE-2026-114616

One pin bumped in place; pip check passes and pip-audit finds nothing.
---
 backend/requirements.lock | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/backend/requirements.lock b/backend/requirements.lock
index 487b8557..c1150acc 100644
--- a/backend/requirements.lock
+++ b/backend/requirements.lock
@@ -6,9 +6,10 @@
 # bumped in place instead of a full regeneration, which would move every other package too — then
 # `pip install -r requirements.lock && pip check` must pass. In place so far: urllib3 2.7.0 -> 2.8.0 (PYSEC-2026-4175/4176/4177); yt-dlp 2026.7.4 -> 2026.8.19
 # (it marks the clients that need a stream PO token, so the downloader stops fetching into a 403);
-# certifi 2026.7.22 -> 2026.10.19 (GHSA-6q48-6c7w-9gw2); brotli 1.2.0 -> 1.2.1 (PYSEC-2026-4322).
+# certifi 2026.7.22 -> 2026.10.19 (GHSA-6q48-6c7w-9gw2); brotli 1.2.0 -> 1.2.1 (PYSEC-2026-4322);
+# Authlib 1.7.2 -> 1.9.1 (CVE-2026-96760, CVE-2026-114616).
 APScheduler==3.11.3
-Authlib==1.7.2
+Authlib==1.9.1
 Mako==1.4.1
 MarkupSafe==3.0.3
 PyYAML==6.0.3

From 6211e15611604a62832c5936c984e20000e85b93 Mon Sep 17 00:00:00 2001
From: npeter83 <npeter83+claude@gmail.com>
Date: Tue, 27 Oct 2026 23:59:09 +0100
Subject: [PATCH 2/2] chore(release): 0.112.1

---
 CHANGELOG.md                               | 6 ++++++
 VERSION                                    | 2 +-
 frontend/src/content/release-notes/en.json | 6 ++++++
 frontend/src/content/release-notes/hu.json | 8 ++++++++
 4 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0a4dafce..88de373e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,12 @@ edit the release notes and re-run the generator.
 
 Upgrading, pinning a version and rolling back: [docs/self-hosting.md](docs/self-hosting.md#upgrading).
 
+## 0.112.1 — 2026-10-27
+
+### Fixed
+
+- Security: the sign-in library is updated, closing two published vulnerabilities.
+
 ## 0.112.0 — 2026-10-25
 
 ### New
diff --git a/VERSION b/VERSION
index e23e3fd2..52afba83 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.112.0
+0.112.1
diff --git a/frontend/src/content/release-notes/en.json b/frontend/src/content/release-notes/en.json
index 4400e7df..de3226ca 100644
--- a/frontend/src/content/release-notes/en.json
+++ b/frontend/src/content/release-notes/en.json
@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.112.1",
+    "date": "2026-10-27",
+    "new": [],
+    "fixed": ["Security: the sign-in library is updated, closing two published vulnerabilities."]
+  },
   {
     "version": "0.112.0",
     "date": "2026-10-25",
diff --git a/frontend/src/content/release-notes/hu.json b/frontend/src/content/release-notes/hu.json
index fbb38432..72277b72 100644
--- a/frontend/src/content/release-notes/hu.json
+++ b/frontend/src/content/release-notes/hu.json
@@ -1,4 +1,12 @@
 [
+  {
+    "version": "0.112.1",
+    "date": "2026-10-27",
+    "new": [],
+    "fixed": [
+      "Biztonság: frissült a bejelentkezési könyvtár, ami két nyilvánosan ismert sérülékenységet zár be."
+    ]
+  },
   {
     "version": "0.112.0",
     "date": "2026-10-25",