From eb94ebe3efb11622a0781aa151769e173d63ca96 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 21 Sep 2026 03:06:38 +0000 Subject: [PATCH 1/2] chore(deps)(deps): bump uvicorn in the web-framework group Bumps the web-framework group with 1 update: [uvicorn](https://github.com/Kludex/uvicorn). Updates `uvicorn` from 0.52.4 to 0.53.0 - [Release notes](https://github.com/Kludex/uvicorn/releases) - [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md) - [Commits](https://github.com/Kludex/uvicorn/compare/0.52.4...0.53.0) --- updated-dependencies: - dependency-name: uvicorn dependency-version: 0.53.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: web-framework ... Signed-off-by: dependabot[bot] --- poetry.lock | 10 +++++----- pyproject.toml | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/poetry.lock b/poetry.lock index 9c697805..6807fee4 100644 --- a/poetry.lock +++ b/poetry.lock @@ -1,4 +1,4 @@ -# This file is automatically @generated by Poetry 2.3.3 and should not be changed by hand. +# This file is automatically @generated by Poetry 2.4.1 and should not be changed by hand. [[package]] name = "annotated-doc" @@ -2308,14 +2308,14 @@ zstd = ["backports-zstd (>=1.0.0) ; python_version < \"3.14\""] [[package]] name = "uvicorn" -version = "0.52.4" +version = "0.53.0" description = "The lightning-fast ASGI server." optional = false python-versions = ">=3.10" groups = ["main"] files = [ - {file = "uvicorn-0.52.4-py3-none-any.whl", hash = "sha256:f86e41a149d7d05a9969337e3946a9c171c06a5d42680896daaba624aeac8da1"}, - {file = "uvicorn-0.52.4.tar.gz", hash = "sha256:73acfee47a0b133c5de13d219492d62d8a31e935f4fe6e41a232451a15379f86"}, + {file = "uvicorn-0.53.0-py3-none-any.whl", hash = "sha256:e8dca71ec86dce5f04e333f0d56cdedf942446e6643b9cea1af0d6d3a02cb03e"}, + {file = "uvicorn-0.53.0.tar.gz", hash = "sha256:a9356f0cb89b3b8621529c5d5eebd69bfe154f4c3f68b4cf2de47e45fa855c2e"}, ] [package.dependencies] @@ -2695,4 +2695,4 @@ dev = ["pytest", "setuptools"] [metadata] lock-version = "2.1" python-versions = "^3.12" -content-hash = "8dd164d3ea9e0833dbca78643fefd7e161ef7bcdbea0625392c3a7bab26e51a0" +content-hash = "e431dd032d19b38b6c9a3dcf9f63ee1dfa56caa343bf98b56872e00c5be2bd4f" diff --git a/pyproject.toml b/pyproject.toml index 42153b31..1f86cb10 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -10,7 +10,7 @@ packages = [{include = "engine"}] [tool.poetry.dependencies] python = "^3.12" fastapi = ">=0.135.2,<0.142.0" -uvicorn = {extras = ["standard"], version = ">=0.42,<0.53"} +uvicorn = {extras = ["standard"], version = ">=0.42,<0.54"} neo4j = "^5.25.0" pydantic = "^2.10.0" pydantic-settings = "^2.6.0" From 298da07b49ea743906fcf40828a42f81b6f98b83 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 21 Sep 2026 22:19:13 +0000 Subject: [PATCH 2/2] fix(deps): sync requirements.txt uvicorn constraint with pyproject.toml pyproject.toml is the runtime dependency authority and this PR moves it to uvicorn >=0.42,<0.54 (locked at 0.53.0). requirements.txt, the file CI and the default Dockerfile install from, still constrained uvicorn <0.43, so green checks exercised 0.42.x instead of the proposed version. Align the single Uvicorn line with the authority; all other lines are unchanged. Closes audit finding F-001 for #286 (ceg-open-pr-audit-20260921T174113Z-437dc00e). Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01WQpMKJNDC7kf7RLkqVP9NF --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index dec56400..66f5d4c0 100644 --- a/requirements.txt +++ b/requirements.txt @@ -3,7 +3,7 @@ # For dev deps: pip install -r requirements-dev.txt fastapi>=0.135.1,<0.136.0 -uvicorn[standard]>=0.41.0,<0.43.0 +uvicorn[standard]>=0.42,<0.54 neo4j>=5.25.0,<6.0.0 pydantic>=2.10.0,<3.0.0 pydantic-settings>=2.6.0,<3.0.0