[ROMzombie]

Dependency Update and Security Review (2026-09-25)

Summary of Updates

This PR reviews project dependencies, scans for known security vulnerabilities and outdated versions, upgrades compatible transitive dependencies to their latest safe minor/patch releases, incorporates CI Discord test completion notifications, and verifies the full test suite.

Dependency Audit

Direct Dependencies (requirements.txt)

All 9 direct dependencies were reviewed and verified to be at their latest releases:

Package	Current Version	Latest Version	Requirement Spec	Category	Security Status
fastapi	0.141.1	0.141.1	>=0.141.1	Up to date	0 CVEs
uvicorn	0.53.0	0.53.0	[standard]>=0.53.0	Up to date	0 CVEs
httpx	0.28.1	0.28.1	>=0.28.1	Up to date	0 CVEs
pillow	12.3.0	12.3.0	>=12.3.0	Up to date	0 CVEs
pydantic	2.13.5	2.13.5	>=2.13.5	Up to date	0 CVEs
python-multipart	0.0.32	0.0.32	>=0.0.32	Up to date	0 CVEs
playwright	1.63.0	1.63.0	>=1.63.0	Up to date	0 CVEs
gradio_client	2.7.1	2.7.1	>=2.7.1	Up to date	0 CVEs
python-dotenv	1.2.3	1.2.3	>=1.2.3	Up to date	0 CVEs

Transitive Dependencies Upgraded (Safe Minor/Patch)

Package	Previous Version	Upgraded Version	Category	Dependency Of
starlette	1.6.0	1.7.0	Minor (Safe)	fastapi
anyio	4.14.2	4.15.1	Minor (Safe)	httpx, starlette
click	8.4.2	8.5.0	Minor (Safe)	uvicorn
greenlet	3.5.5	3.5.6	Patch (Safe)	playwright
idna	3.19	3.20	Patch (Safe)	httpx
tqdm	4.70.0	4.70.1	Patch (Safe)	huggingface-hub
watchfiles	1.2.0	1.3.0	Minor (Safe)	uvicorn[standard]
websockets	17.0.1	17.1	Minor (Safe)	uvicorn[standard], gradio_client
fsspec	2026.7.0	2026.9.0	Minor (Safe)	gradio_client

Upgrades Skipped / Blocked by Direct Package Pins

Package	Current Version	Available	Reason Skipped
huggingface_hub	1.28.0	2.0.0 (Major)	Blocked by gradio_client 2.7.1 dependency constraint (<2.0,>=0.19.3).
filelock	3.32.3	4.0.3 (Major)	Blocked by huggingface_hub <2.0.
pyee	13.0.1	14.0.0 (Major)	Blocked by playwright 1.63.0 dependency constraint (<14,>=13).
pydantic_core	2.46.5	2.49.0 (Minor)	Blocked by pydantic 2.13.5 exact equality pin (pydantic-core==2.46.5).

Security Findings & Vulnerability Scan

• OSV Database Scan: Queried Open Source Vulnerability (OSV) API across all 38 installed packages. Result: 0 known vulnerabilities.
• GitHub Dependabot Scan: Queried repository pull requests and alerts. Result: 0 open Dependabot pull requests, 0 alerts.

Additional Changes Included

• Discord CI PR Notification: Incorporated .github/scripts/notify_discord.py, updated .github/workflows/ci.yml, and added unit tests in tests/test_notify_discord.py to notify Discord upon successful PR CI test completion.

Verification & Quality Gates

• Full Test Suite:
  • tests/test_grok.py, tests/test_janus.py, tests/test_api.py, tests/test_pipeline.py, tests/test_samples.py, tests/test_notify_discord.py: 65 / 65 passed (OK).
  • tests/test_proxies.py, tests/test_perchance.py: 13 / 13 passed (OK).
  • Total tests executed and passed: 78 / 78 (100% OK).
• Dependency Consistency: pip check reports No broken requirements found.