65c31cf88f
Some checks failed
CI / lint (push) Successful in 31s
CI / notebooks-smoke (push) Successful in 1m30s
Deploy / notebooks (push) Has been skipped
Deploy / zotero (push) Has been skipped
Deploy / docs (push) Has been skipped
Deploy / api (push) Successful in 52s
Deploy / mc (push) Has been skipped
Infra CI / notebooks (push) Successful in 1m4s
Infra CI / zotero (push) Successful in 23s
Infra CI / docs (push) Successful in 13s
Infra CI / api (push) Successful in 13s
Infra CI / mc (push) Successful in 14s
Package Supply Chain / pkg-supply-chain (push) Successful in 1m20s
Deploy / report (push) Successful in 13s
CI / test (push) Failing after 14m30s
aiohttp 3.13.5→3.14.1 (11 CVEs: pipelining/websocket/parser DoS, cookie handling — all server-side or unused-API paths here) starlette 0.52.1→1.3.1 + fastapi 0.135.1→0.139.0 (5 CVEs: request.url reconstruction, urlencoded form limits, StaticFiles UNC SSRF) pyjwt 2.12.1→2.13.0 (5 CVEs: JWK/JWKS verifier paths — we use static HS256 secret with pinned allow-list) cryptography 46.0.7→49.0.0 (bundled OpenSSL per 2026-06-09 advisory, incl. CVE-2026-45447 PKCS7_verify UAF) urllib3 2.6.3→2.7.0, idna 3.11→3.18, pyarrow 23.0.0→25.0.0 Per-issue exploitability rationale in tracker issues #519-#544. Full suite green: 13901 passed. pyproject floors raised for direct deps; pkg-manifest regenerated.