diff --git a/constraints/security.txt b/constraints/security.txt index 628cc4f72..ea9b858e0 100644 --- a/constraints/security.txt +++ b/constraints/security.txt @@ -123,7 +123,7 @@ Brotli>=1.2.0 # Vulnerable: >= 10.3.0, < 12.2.0. Pillow enters the install tree via # scientific/ML extras (e.g. torchvision-adjacent paths). Pin the floor # here so transitive resolution cannot regress below the fix line. -pillow>=12.2.0 +pillow>=12.3.0 # Security floors — CVE remediation (pip-audit 2026-06-19). # tornado: GHSA-3x9g-8vmp-wqvf, GHSA-cx3h-4qpv-8hc9, GHSA-mgf9-4vpg-hj56, GHSA-pw6j-qg29-8w7f diff --git a/requirements-dev.lock b/requirements-dev.lock index ae6b9b803..74d2be079 100644 --- a/requirements-dev.lock +++ b/requirements-dev.lock @@ -38,6 +38,8 @@ anyio==4.11.0 # via # httpx # starlette +arrow==1.4.0 + # via isoduration async-timeout==5.0.1 # via aiokafka attrs==25.4.0 @@ -55,6 +57,8 @@ black==26.3.1 # via geosync (pyproject.toml) blinker==1.9.0 # via streamlit +boolean-py==5.0 + # via license-expression bracex==2.6 # via cibuildwheel build==1.3.0 @@ -80,6 +84,8 @@ cffi==2.0.0 # via # cryptography # pycares +chardet==5.2.0 + # via cyclonedx-bom charset-normalizer==3.4.4 # via # -c constraints/security.txt @@ -118,8 +124,14 @@ cuda-pathfinder==1.5.2 # via cuda-bindings cuda-toolkit[cublas,cudart,cufft,cufile,cupti,curand,cusolver,cusparse,nvjitlink,nvrtc,nvtx]==13.0.2 # via torch +cyclonedx-bom==7.3.0 + # via geosync (pyproject.toml) +cyclonedx-python-lib[validation]==11.11.0 + # via cyclonedx-bom deap==1.4.3 # via geosync (pyproject.toml) +defusedxml==0.7.1 + # via py-serializable dependency-groups==1.3.1 # via cibuildwheel docutils==0.22.2 @@ -141,6 +153,8 @@ filelock==3.20.3 # torch flake8==7.1.1 # via geosync (pyproject.toml) +fqdn==1.5.1 + # via jsonschema frozenlist==1.8.0 # via # aiohttp @@ -190,6 +204,7 @@ idna==3.18 # -c constraints/security.txt # anyio # httpx + # jsonschema # requests # yarl import-linter==2.11 @@ -198,6 +213,8 @@ importlib-metadata==8.7.0 # via opentelemetry-api iniconfig==2.1.0 # via pytest +isoduration==20.11.0 + # via jsonschema isort==5.13.2 # via geosync (pyproject.toml) jaraco-classes==3.4.0 @@ -230,22 +247,33 @@ joblib==1.5.2 # via # geosync (pyproject.toml) # scikit-learn -jsonschema==4.25.1 - # via altair +jsonpointer==3.1.1 + # via jsonschema +jsonschema[format-nongpl]==4.25.1 + # via + # altair + # cyclonedx-python-lib + # geosync (pyproject.toml) jsonschema-specifications==2025.9.1 # via jsonschema keyring==25.6.0 # via twine korean-lunar-calendar==0.3.1 # via exchange-calendars +lark==1.3.1 + # via rfc3987-syntax libcst==1.7.0 # via mutmut librt==0.9.0 # via mypy +license-expression==30.4.4 + # via cyclonedx-python-lib linkify-it-py==2.0.3 # via markdown-it-py llvmlite==0.46.0 # via numba +lxml==6.1.1 + # via cyclonedx-python-lib mako==1.3.12 # via # -c constraints/security.txt @@ -392,6 +420,10 @@ opt-einsum==3.4.0 # via jax optuna==3.6.2 # via geosync (pyproject.toml) +packageurl-python==0.17.6 + # via + # cyclonedx-bom + # cyclonedx-python-lib packaging==25.0 # via # aiokafka @@ -399,10 +431,12 @@ packaging==25.0 # black # build # cibuildwheel + # cyclonedx-bom # dependency-groups # hydra-core # optuna # pandera + # pip-requirements-parser # pytest # pytest-rerunfailures # strawberry-graphql @@ -424,11 +458,13 @@ pathspec==1.0.0 # via # black # mypy -pillow==12.2.0 +pillow==12.3.0 # via # -c constraints/security.txt # captcha # streamlit +pip-requirements-parser==32.0.1 + # via cyclonedx-bom pip-tools==7.5.1 # via geosync (pyproject.toml) platformdirs==4.5.0 @@ -466,6 +502,8 @@ psycopg-binary==3.2.11 # via psycopg py-cpuinfo==9.0.0 # via pytest-benchmark +py-serializable==2.1.0 + # via cyclonedx-python-lib py-spy==0.4.1 # via geosync (pyproject.toml) pyarrow==24.0.0 @@ -514,6 +552,8 @@ pyjwt[crypto]==2.13.0 # streamlit-authenticator pyluach==2.3.0 # via exchange-calendars +pyparsing==3.3.2 + # via pip-requirements-parser pyproject-hooks==1.2.0 # via # build @@ -553,6 +593,7 @@ pytest-xdist==3.8.0 # via geosync (pyproject.toml) python-dateutil==2.9.0.post0 # via + # arrow # pandas # strawberry-graphql python-dotenv==1.2.2 @@ -580,6 +621,7 @@ redis==7.0.0 # via geosync (pyproject.toml) referencing==0.37.0 # via + # cyclonedx-python-lib # jsonschema # jsonschema-specifications requests==2.34.2 @@ -594,8 +636,14 @@ requests==2.34.2 # twine requests-toolbelt==1.0.0 # via twine +rfc3339-validator==0.1.4 + # via jsonschema rfc3986==2.0.0 # via twine +rfc3986-validator==0.1.1 + # via jsonschema +rfc3987-syntax==1.1.0 + # via jsonschema rich==14.2.0 # via # bandit @@ -630,12 +678,15 @@ six==1.17.0 # via # pytest-profiling # python-dateutil + # rfc3339-validator smmap==5.0.2 # via gitdb sniffio==1.3.1 # via anyio sortedcontainers==2.4.0 - # via hypothesis + # via + # cyclonedx-python-lib + # hypothesis sqlalchemy==2.0.51 # via # -c constraints/security.txt @@ -703,6 +754,7 @@ typing-extensions==4.15.0 # anyio # ccxt # cross-web + # cyclonedx-python-lib # fastapi # grimp # grpcio @@ -737,10 +789,13 @@ typing-inspection==0.4.2 # pydantic-settings tzdata==2025.2 # via + # arrow # exchange-calendars # pandas uc-micro-py==1.0.3 # via linkify-it-py +uri-template==1.3.0 + # via jsonschema urllib3==2.7.0 # via # -c constraints/security.txt @@ -750,6 +805,8 @@ uvicorn==0.49.0 # via geosync (pyproject.toml) watchdog==6.0.0 # via streamlit +webcolors==25.10.0 + # via jsonschema websockets==15.0.1 # via geosync (pyproject.toml) wheel==0.47.0 diff --git a/requirements-scan.lock b/requirements-scan.lock index b886455d5..cb065b169 100644 --- a/requirements-scan.lock +++ b/requirements-scan.lock @@ -74,7 +74,7 @@ optuna==3.6.2 packaging==25.0 pandas==2.3.3 pandera==0.32.0 -pillow==12.2.0 +pillow==12.3.0 prometheus-client==0.25.0 propcache==0.4.1 protobuf==6.33.5 diff --git a/requirements.lock b/requirements.lock index 7943b4de1..ffd324649 100644 --- a/requirements.lock +++ b/requirements.lock @@ -310,7 +310,7 @@ pandera==0.32.0 # via # -c constraints/security.txt # geosync (pyproject.toml) -pillow==12.2.0 +pillow==12.3.0 # via # -c constraints/security.txt # captcha