Skip to content

chore(deps): bump the pip group across 1 directory with 21 updates #69

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
dependabot wants to merge 1 commit into from
Closed

chore(deps): bump the pip group across 1 directory with 21 updates #69

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 10 additions & 10 deletions requirements-dev.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,32 +5,32 @@
-r requirements.txt

# Testing
pytest==9.0.3
pytest==9.1.1
pytest-asyncio==1.4.0 # Updated for Python 3.12 event loop compatibility
pytest-cov==7.1.0
pytest-mock==3.15.1
coverage==7.14.1
coverage==7.15.4

# Code Quality
black==26.5.1 # Code formatting - Updated for Python 3.12
flake8==7.3.0 # Linting
isort==8.0.1 # Import sorting
mypy==2.1.0 # Type checking - Updated for Python 3.12
pylint==4.0.5 # Advanced linting
isort==9.0.0 # Import sorting

@codacy-production codacy-production Bot Aug 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 MEDIUM RISK

Suggestion: Bumping to a new major version of isort (9.0.0) often introduces changes to sorting logic. If the codebase has not been re-formatted with this new version, linting checks in CI are likely to fail. Try running the following prompt in your coding agent: > Re-format the entire codebase using isort 9.0.0 and black 26.5.1 to ensure compliance with the updated rules and verify CI passes.

mypy==2.3.1 # Type checking - Updated for Python 3.12
pylint==4.0.7 # Advanced linting

# Development Tools
ipython==9.14.1 # Enhanced Python shell
ipython==9.16.1 # Enhanced Python shell
ipdb==0.13.13 # Debugger
pre-commit==4.6.0 # Git hooks for code quality
pre-commit==4.6.2 # Git hooks for code quality

# Documentation
mkdocs==1.6.1
mkdocs-material==9.7.6
mkdocs-material==9.7.7

# Database Tools
sqlalchemy-utils==0.42.1

# Testing Utilities
faker==40.23.0 # Generate test data
faker==40.37.0 # Generate test data
freezegun==1.5.5 # Mock datetime (1.5+ required for Python 3.13)
responses==0.26.1 # Mock HTTP requests
responses==0.26.3 # Mock HTTP requests
22 changes: 11 additions & 11 deletions requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,32 +2,32 @@
# Production requirements

# Web Framework
fastapi==0.136.3
uvicorn[standard]==0.49.0
fastapi==0.141.1
uvicorn[standard]==0.52.4
python-multipart==0.0.32 # Required for UploadFile (file import endpoint); 0.0.27 fixes DoS via unbounded multipart headers (Dependabot #8)

# Database
sqlalchemy==2.0.50
alembic==1.18.4 # Database migrations
sqlalchemy==2.0.52
alembic==1.19.1 # Database migrations

# Scheduling
apscheduler==3.11.2
pytz==2026.2
apscheduler==3.11.3
pytz==2026.3.post1

# SMS Provider
twilio==9.10.9
twilio==9.11.0

# Data Validation
pydantic==2.13.4
pydantic-settings==2.14.1
pydantic-settings==2.15.0

# Utilities
python-dotenv==1.2.2
python-dotenv==1.2.3
httpx==0.28.1 # Async HTTP client

# Security
argon2-cffi==25.1.0 # Argon2id password hashing (OWASP 2025 recommended)
cryptography>=48.0.1,<49 # Fernet + PBKDF2 for at-rest encryption of Twilio auth tokens (WHO-43); floor bumped past CVE-flagged ranges (CodeRabbit)
cryptography>=50.0.1,<51 # Fernet + PBKDF2 for at-rest encryption of Twilio auth tokens (WHO-43); floor bumped past CVE-flagged ranges (CodeRabbit)

@codacy-production codacy-production Bot Aug 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 MEDIUM RISK

This update performs a major version jump for cryptography (48.x to 50.x), skipping version 49. Major releases in this library can introduce breaking changes or deprecate ciphers. It is safer to update this package separately and verify that the Twilio auth token encryption/decryption logic remains functional. Try running the following prompt in your coding agent: > Review the cryptography 50.x release notes for breaking changes related to Fernet and PBKDF2, then run the test suite to verify Twilio token encryption/decryption.


# Logging
python-json-logger==4.1.0
python-json-logger==4.2.0