From 5a1d5106b0282592e6fad3be03ace89c0690e499 Mon Sep 17 00:00:00 2001 From: Greg Svoboda <13701780+gregsvo@users.noreply.github.com> Date: Thu, 29 Oct 2026 16:19:48 -0400 Subject: [PATCH] chore(deps): refresh the lockfile for security advisories The weekly dependency scan, and the audit that runs before publishing to PyPI, were failing on anyio, certifi, dnspython, filelock, sqlparse and virtualenv. Update them with Poetry 2.4.1, the version CI uses. The fixed releases of dnspython and filelock need Python 3.11 or newer, so a plain update left the vulnerable builds in place for 3.11-3.14. Add minimum versions for both to the dev group, split by Python version. That group is not published, so the package's dependencies are unchanged. Python 3.10 keeps the older dnspython and filelock because no fixed release supports it; the audits run on 3.12. --- poetry.lock | 127 +++++++++++++++++++++++++++++++------------------ pyproject.toml | 10 ++++ 2 files changed, 90 insertions(+), 47 deletions(-) diff --git a/poetry.lock b/poetry.lock index a759a08..4fe7a0f 100644 --- a/poetry.lock +++ b/poetry.lock @@ -14,20 +14,20 @@ files = [ [[package]] name = "anyio" -version = "4.13.0" +version = "4.15.1" description = "High-level concurrency and networking framework on top of asyncio or Trio" optional = false python-versions = ">=3.10" groups = ["main", "dev"] files = [ - {file = "anyio-4.13.0-py3-none-any.whl", hash = "sha256:08b310f9e24a9594186fd75b4f73f4a4152069e3853f1ed8bfbf58369f4ad708"}, - {file = "anyio-4.13.0.tar.gz", hash = "sha256:334b70e641fd2221c1505b3890c69882fe4a2df910cba14d97019b90b24439dc"}, + {file = "anyio-4.15.1-py3-none-any.whl", hash = "sha256:6152fdbbf9a77fdec97731721bebf7c4c44f7c29b424b0065826173efc7ed101"}, + {file = "anyio-4.15.1.tar.gz", hash = "sha256:9f28306018cbd6d329e64a36d58256edff76dd996fe423bc957326e578b82a94"}, ] [package.dependencies] exceptiongroup = {version = ">=1.0.2", markers = "python_version < \"3.11\""} idna = ">=2.8" -typing_extensions = {version = ">=4.5", markers = "python_version < \"3.13\""} +typing_extensions = {version = ">=4.16.0", markers = "python_version < \"3.15\""} [package.extras] trio = ["trio (>=0.32.0)"] @@ -111,14 +111,14 @@ files = [ [[package]] name = "certifi" -version = "2026.2.25" +version = "2026.10.23" description = "Python package for providing Mozilla's CA Bundle." optional = false python-versions = ">=3.7" groups = ["main", "dev"] files = [ - {file = "certifi-2026.2.25-py3-none-any.whl", hash = "sha256:027692e4402ad994f1c42e52a4997a9763c646b73e4096e4d5d6db8af1d6f0fa"}, - {file = "certifi-2026.2.25.tar.gz", hash = "sha256:e887ab5cee78ea814d3472169153c2d12cd43b14bd03329a39a9c6e2e80bfba7"}, + {file = "certifi-2026.10.23-py3-none-any.whl", hash = "sha256:e9b54de76e530bb6cf0ccd036787103acb58fd42ba930ea8bf948ddbaa2f61d1"}, + {file = "certifi-2026.10.23.tar.gz", hash = "sha256:a9895e6e2758b371e0545e321a3a8fd1fcfd9829ada8824a936dfb16aaaf36cd"}, ] [[package]] @@ -270,14 +270,14 @@ toml = ["tomli ; python_full_version <= \"3.11.0a6\""] [[package]] name = "distlib" -version = "0.4.0" +version = "0.4.4" description = "Distribution utilities" optional = false python-versions = "*" groups = ["dev"] files = [ - {file = "distlib-0.4.0-py2.py3-none-any.whl", hash = "sha256:9659f7d87e46584a30b5780e43ac7a2143098441670ff0a49d5f9034c54a6c16"}, - {file = "distlib-0.4.0.tar.gz", hash = "sha256:feec40075be03a04501a973d81f633735b4b69f98b05450592310c0f401a4e0d"}, + {file = "distlib-0.4.4-py2.py3-none-any.whl", hash = "sha256:cf09d55b1e85a89576b036aeb71550bfd68320f3f21761ca329eadadad918638"}, + {file = "distlib-0.4.4.tar.gz", hash = "sha256:ca4175b4ac7f71223cc30ed7248c45d2b38c2439d8ee6e498ab67ed63cf3508d"}, ] [[package]] @@ -308,7 +308,8 @@ version = "2.8.0" description = "DNS toolkit" optional = false python-versions = ">=3.10" -groups = ["main"] +groups = ["main", "dev"] +markers = "python_version == \"3.10\"" files = [ {file = "dnspython-2.8.0-py3-none-any.whl", hash = "sha256:01d9bbc4a2d76bf0db7c1f729812ded6d912bd318d3b1cf81d30c0f845dbf3af"}, {file = "dnspython-2.8.0.tar.gz", hash = "sha256:181d3c6996452cb1189c4046c61599b84a5a86e099562ffde77d26984ff26d0f"}, @@ -323,6 +324,28 @@ idna = ["idna (>=3.10)"] trio = ["trio (>=0.30)"] wmi = ["wmi (>=1.5.1) ; platform_system == \"Windows\""] +[[package]] +name = "dnspython" +version = "2.9.0" +description = "DNS toolkit" +optional = false +python-versions = ">=3.11" +groups = ["main", "dev"] +markers = "python_version >= \"3.11\"" +files = [ + {file = "dnspython-2.9.0-py3-none-any.whl", hash = "sha256:9a4aedb833c3c1b49214d04d44d3032ab7a9135f7c1d29a549b4ff78fd82fda9"}, + {file = "dnspython-2.9.0.tar.gz", hash = "sha256:b44dc6b18f07a8b1c56676a19fbfdb5209415b046a9cece286baafa87ff3f7f1"}, +] + +[package.extras] +dev = ["black (>=26.5)", "coverage (>=7.15)", "hypercorn (>=0.18.0)", "pyright (>=1.1.411)", "pytest (>=9.1)", "pytest-cov (>=7.1)", "quart-trio (>=0.12.0)", "ruff (>=0.16.0)", "sphinx (>=9.1.0) ; python_full_version >= \"3.12.0\"", "sphinx-rtd-theme (>=3.1.0) ; python_full_version >= \"3.12.0\"", "trustme (>=1.2.1)", "ty (>=0.0.85)"] +dnssec = ["cryptography (>=50)"] +doh = ["h2 (>=4.4)", "httpcore2 (>=2.13)", "httpx2 (>=2.13)"] +doq = ["aioquic (>=1.3.0)"] +idna = ["idna (>=3.20)"] +trio = ["trio (>=0.34)"] +wmi = ["wmi (>=1.5.1) ; sys_platform == \"win32\""] + [[package]] name = "email-validator" version = "2.3.0" @@ -360,14 +383,28 @@ test = ["pytest (>=6)"] [[package]] name = "filelock" -version = "3.25.2" +version = "4.1.0" description = "A platform independent file lock." optional = false python-versions = ">=3.10" groups = ["dev"] +markers = "python_version == \"3.10\"" +files = [ + {file = "filelock-4.1.0-py3-none-any.whl", hash = "sha256:2ce9818e3e2d8f284c1a964414447ef148d42a5fd5e2a477a7118e574b293ec1"}, + {file = "filelock-4.1.0.tar.gz", hash = "sha256:ad7f724afef953e731b1cc39bcd3a09166d72ed7fcdf29e6e88b1c3235c6715d"}, +] + +[[package]] +name = "filelock" +version = "4.2.4" +description = "A platform independent file lock." +optional = false +python-versions = ">=3.11" +groups = ["dev"] +markers = "python_version >= \"3.11\"" files = [ - {file = "filelock-3.25.2-py3-none-any.whl", hash = "sha256:ca8afb0da15f229774c9ad1b455ed96e85a81373065fb10446672f64444ddf70"}, - {file = "filelock-3.25.2.tar.gz", hash = "sha256:b64ece2b38f4ca29dd3e810287aa8c48182bbecd1ae6e9ae126c9b35f1382694"}, + {file = "filelock-4.2.4-py3-none-any.whl", hash = "sha256:301241438c57936ef93f4243a94f2559022268bfcf9b375a9a72eb0f8db8358e"}, + {file = "filelock-4.2.4.tar.gz", hash = "sha256:c6d8663535e1650ee430507b4ffbac7b464dd64b7647ea0112a9f406499d163d"}, ] [[package]] @@ -680,14 +717,14 @@ files = [ [[package]] name = "packaging" -version = "26.0" +version = "26.3" description = "Core utilities for Python packages" optional = false -python-versions = ">=3.8" +python-versions = ">=3.9" groups = ["dev"] files = [ - {file = "packaging-26.0-py3-none-any.whl", hash = "sha256:b36f1fef9334a5588b4166f8bcd26a14e521f2b55e6b9de3aaa80d3ff7a37529"}, - {file = "packaging-26.0.tar.gz", hash = "sha256:00243ae351a257117b6a241061796684b084ed1c516a08c48a3f7e147a9d80b4"}, + {file = "packaging-26.3-py3-none-any.whl", hash = "sha256:d7193f7c8e4e93f444fde0262bf90af30e16fa0ad0ad44cb553c87339b23cd1c"}, + {file = "packaging-26.3.tar.gz", hash = "sha256:94edc256424af38762eb31306eed28beb9f0efc50a8837492c9d6fd6004aed79"}, ] [[package]] @@ -992,23 +1029,18 @@ testing = ["process-tests", "pytest-xdist", "virtualenv"] [[package]] name = "python-discovery" -version = "1.2.2" +version = "1.6.7" description = "Python interpreter discovery" optional = false -python-versions = ">=3.8" +python-versions = ">=3.9" groups = ["dev"] files = [ - {file = "python_discovery-1.2.2-py3-none-any.whl", hash = "sha256:e1ae95d9af875e78f15e19aed0c6137ab1bb49c200f21f5061786490c9585c7a"}, - {file = "python_discovery-1.2.2.tar.gz", hash = "sha256:876e9c57139eb757cb5878cbdd9ae5379e5d96266c99ef731119e04fffe533bb"}, + {file = "python_discovery-1.6.7-py3-none-any.whl", hash = "sha256:5422f67e5f533bb02d7b73de1c422ed74037536fd869e05156c07565926ec68e"}, + {file = "python_discovery-1.6.7.tar.gz", hash = "sha256:7f7c28568c8ec3d988d8bddbdbec8e65f08e8767e52f734e18b8b498549b9b70"}, ] [package.dependencies] -filelock = ">=3.15.4" -platformdirs = ">=4.3.6,<5" - -[package.extras] -docs = ["furo (>=2025.12.19)", "sphinx (>=9.1)", "sphinx-autodoc-typehints (>=3.6.3)", "sphinxcontrib-mermaid (>=2)"] -testing = ["covdefaults (>=2.3)", "coverage (>=7.5.4)", "pytest (>=8.3.5)", "pytest-mock (>=3.14)", "setuptools (>=75.1)"] +filelock = ">=3.16.1" [[package]] name = "python-dotenv" @@ -1153,20 +1185,20 @@ files = [ [[package]] name = "sqlparse" -version = "0.5.5" +version = "0.6.0" description = "A non-validating SQL parser." optional = false -python-versions = ">=3.8" +python-versions = ">=3.10" groups = ["main", "dev"] files = [ - {file = "sqlparse-0.5.5-py3-none-any.whl", hash = "sha256:12a08b3bf3eec877c519589833aed092e2444e68240a3577e8e26148acc7b1ba"}, - {file = "sqlparse-0.5.5.tar.gz", hash = "sha256:e20d4a9b0b8585fdf63b10d30066c7c94c5d7a7ec47c889a2d83a3caa93ff28e"}, + {file = "sqlparse-0.6.0-py3-none-any.whl", hash = "sha256:b861c0288ce2fa56209a9a6412d2e066ac664b3873b89c26c9d8415e8e32996f"}, + {file = "sqlparse-0.6.0.tar.gz", hash = "sha256:113c35c75365ab9cc9c7231d68c6428fb11c085fc8e9eb1ad659b7ddbf6cd2b9"}, ] markers = {main = "extra == \"django\""} [package.extras] dev = ["build"] -doc = ["sphinx"] +doc = ["furo", "sphinx"] [[package]] name = "tenacity" @@ -1191,7 +1223,7 @@ description = "A lil' TOML parser" optional = false python-versions = ">=3.8" groups = ["dev"] -markers = "python_full_version <= \"3.11.0a6\"" +markers = "python_version == \"3.10\"" files = [ {file = "tomli-2.4.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:f8f0fc26ec2cc2b965b7a3b87cd19c5c6b8c5e5f436b984e85f486d652285c30"}, {file = "tomli-2.4.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:4ab97e64ccda8756376892c53a72bd1f964e519c77236368527f758fbc36a53a"}, @@ -1244,14 +1276,14 @@ files = [ [[package]] name = "typing-extensions" -version = "4.15.0" +version = "4.16.0" description = "Backported and Experimental Type Hints for Python 3.9+" optional = false python-versions = ">=3.9" groups = ["main", "dev"] files = [ - {file = "typing_extensions-4.15.0-py3-none-any.whl", hash = "sha256:f0fa19c6845758ab08074a0cfa8b7aecb71c999ca73d62883bc25cc018c4e548"}, - {file = "typing_extensions-4.15.0.tar.gz", hash = "sha256:0cea48d173cc12fa28ecabc3b837ea3cf6f38c6d1136f85cbaaf598984861466"}, + {file = "typing_extensions-4.16.0-py3-none-any.whl", hash = "sha256:481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8"}, + {file = "typing_extensions-4.16.0.tar.gz", hash = "sha256:dc983d19a509c94dba722ee6abd33940f7c05a89e243c47e907eb4db6f1a43e5"}, ] [[package]] @@ -1284,22 +1316,23 @@ markers = {main = "extra == \"django\" and sys_platform == \"win32\"", dev = "sy [[package]] name = "virtualenv" -version = "21.2.3" +version = "21.15.1" description = "Virtual Python Environment builder" optional = false -python-versions = ">=3.8" +python-versions = ">=3.9" groups = ["dev"] files = [ - {file = "virtualenv-21.2.3-py3-none-any.whl", hash = "sha256:486652347ea8526d91e9807c0274583cb7ba31dd4942ff10fb5621402f0fe0d8"}, - {file = "virtualenv-21.2.3.tar.gz", hash = "sha256:9bb6d1414ab55ca624371e30c7719c32f183ef44da544ef8aa44a456de7ac191"}, + {file = "virtualenv-21.15.1-py3-none-any.whl", hash = "sha256:0d14a991689c67600316880eadc0a37b7690cb632e3b4ac67e2bc05b2b2e24a4"}, + {file = "virtualenv-21.15.1.tar.gz", hash = "sha256:e79c90b8f601701599c25905e02839924fede2c798d52325670d24fbdaab74ee"}, ] [package.dependencies] -distlib = ">=0.3.7,<1" -filelock = {version = ">=3.24.2,<4", markers = "python_version >= \"3.10\""} -platformdirs = ">=3.9.1,<5" -python-discovery = ">=1.2.2" -typing-extensions = {version = ">=4.13.2", markers = "python_version < \"3.11\""} +distlib = ">=0.4.3,<1" +filelock = {version = ">=3.24.2,<5", markers = "python_version >= \"3.10\""} +packaging = ">=26.3" +platformdirs = ">=4.4,<5" +python-discovery = ">=1.6.1" +typing-extensions = {version = ">=4.16", markers = "python_version < \"3.11\""} [extras] django = ["django"] @@ -1307,4 +1340,4 @@ django = ["django"] [metadata] lock-version = "2.1" python-versions = ">=3.10,<4.0" -content-hash = "67966c7132e9bf15848d4baba65fbf2afb81c49b15a5b342d54e306f294da759" +content-hash = "bc671977f0efdde3d947f23ad63aceafaadb7890e8798cccbce3e520a5969cbc" diff --git a/pyproject.toml b/pyproject.toml index e04ba74..ecd023e 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -53,6 +53,16 @@ ruff = "^0.16.5" pre-commit = "^4.6.2" python-dotenv = "^1.2.3" django = "^5.2" # For running tests/django/ locally; CI matrix also covers 4.2, 6.0, 6.1 +# Security floors for transitive packages. Their fixed releases need Python >= 3.11, so +# without these the lock keeps the vulnerable build for 3.11-3.14. Dev group only: not published. +dnspython = [ + { version = ">=2.9.0", python = ">=3.11" }, + { version = ">=2.0.0", python = "<3.11" }, +] +filelock = [ + { version = ">=4.2.1", python = ">=3.11" }, + { version = ">=3.24.2", python = "<3.11" }, +] [tool.ruff] line-length = 88