From 26d3d4ce231971fc48c43054d5da30d8950fdc22 Mon Sep 17 00:00:00 2001 From: goetchstone Date: Thu, 9 Jul 2026 06:19:54 -0400 Subject: [PATCH 1/2] fix(deps): bump python-multipart to 0.0.32 and pytest to 9.0.3 for security alerts Clears all 8 open Dependabot alerts: python-multipart DoS/file-write CVEs (fixed 0.0.31) and pytest tmpdir handling (fixed 9.0.3, no fix on 8.x line). Co-Authored-By: Claude Fable 5 --- pyproject.toml | 4 ++-- requirements.txt | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index 6c73c48..b98afe9 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -10,7 +10,7 @@ dependencies = [ "fastapi>=0.110", "uvicorn>=0.29", "jinja2>=3.1", - "python-multipart>=0.0.9", + "python-multipart>=0.0.31", "keyring>=24", ] @@ -21,7 +21,7 @@ desktop = [ "pywebview>=5.1", ] dev = [ - "pytest>=8", + "pytest>=9.0.3", "pytest-asyncio>=0.23", "pytest-timeout>=2.3", "pytest-cov>=5", diff --git a/requirements.txt b/requirements.txt index 3c31166..3073588 100644 --- a/requirements.txt +++ b/requirements.txt @@ -9,10 +9,10 @@ fastapi==0.128.8 uvicorn[standard]==0.39.0 jinja2==3.1.6 -python-multipart==0.0.20 +python-multipart==0.0.32 keyring==25.7.0 # --- tests --- -pytest==8.4.2 +pytest==9.0.3 pytest-asyncio==1.2.0 httpx==0.28.1 From 2d69f81e1bf572e09ec11b2b50d47e2ebd29dbd2 Mon Sep 17 00:00:00 2001 From: goetchstone Date: Thu, 9 Jul 2026 07:09:22 -0400 Subject: [PATCH 2/2] chore: require Python >=3.10 (3.9 is EOL; needed for patched python-multipart) python-multipart >=0.0.21 requires Python 3.10+, and the security fixes land in 0.0.31. Python 3.9 reached end-of-life in October 2025. Co-Authored-By: Claude Fable 5 --- .github/workflows/ci.yml | 2 +- pyproject.toml | 2 +- requirements.txt | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 6ea8e7b..41c3f25 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -13,7 +13,7 @@ jobs: fail-fast: false matrix: os: [ubuntu-latest, macos-latest] - python: ["3.9", "3.12"] + python: ["3.10", "3.12"] runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@v4 diff --git a/pyproject.toml b/pyproject.toml index b98afe9..b4c8eaf 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -3,7 +3,7 @@ name = "gamgui" version = "0.0.1" description = "A local, open-source macOS GUI for managing Google Workspace via GAM7 (connector-ready)." readme = "README.md" -requires-python = ">=3.9" +requires-python = ">=3.10" license = { text = "MIT" } authors = [{ name = "GamGUI contributors" }] dependencies = [ diff --git a/requirements.txt b/requirements.txt index 3073588..bd12b37 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,4 +1,4 @@ -# Pinned, known-good dependency set (macOS / Linux, Python 3.9+). +# Pinned, known-good dependency set (macOS / Linux, Python 3.10+). # Runtime + test tooling. For an exact reproducible install: pip install -r requirements.txt # (pyproject.toml is the flexible source of truth: pip install -e ".[dev]") #