[ROMzombie]

Dependency Update and Security Review (2026-10-05)

Summary of Updates

This PR reviews project dependencies, scans for known security vulnerabilities and outdated versions, upgrades compatible direct and transitive dependencies to their latest safe minor and patch releases, and verifies the full test suite.

Dependency Audit

Direct Dependencies (requirements.txt)

Package	Previous Pin	Upgraded Pin	Installed Version	Category	Security Status
fastapi	>=0.141.1	>=0.142.2	0.142.2	Minor (Safe)	0 CVEs
uvicorn[standard]	>=0.53.0	>=0.54.0	0.54.0	Minor (Safe)	0 CVEs
gradio_client	>=2.7.1	>=2.7.2	2.7.2	Patch (Safe)	0 CVEs
python-dotenv	>=1.2.3	>=1.2.4	1.2.4	Patch (Safe)	0 CVEs
playwright	>=1.63.0	>=1.63.0	1.63.0	Up to date	0 CVEs
httpx	>=0.28.1	>=0.28.1	0.28.1	Up to date	0 CVEs
pillow	>=12.3.0	>=12.3.0	12.3.0	Up to date	0 CVEs
pydantic	>=2.13.5	>=2.13.5	2.13.5	Up to date	0 CVEs
python-multipart	>=0.0.32	>=0.0.32	0.0.32	Up to date	0 CVEs

Transitive Dependencies Upgraded (Safe Minor/Patch)

Package	Previous Version	Upgraded Version	Category	Dependency Of
anyio	4.14.2	4.15.1	Minor (Safe)	httpx, starlette
greenlet	3.5.5	3.5.6	Patch (Safe)	playwright
idna	3.19	3.20	Patch (Safe)	httpx
starlette	1.6.0	1.7.0	Minor (Safe)	fastapi
tqdm	4.70.0	4.70.1	Patch (Safe)	huggingface-hub
watchfiles	1.2.0	1.3.0	Minor (Safe)	uvicorn[standard]
websockets	17.1	17.2	Minor (Safe)	uvicorn[standard], gradio_client
fsspec	2026.7.0	2026.9.0	Minor (Safe)	gradio_client
opentelemetry-api	(none)	1.45.0	New Transitive	fastapi 0.142.2

Upgrades Skipped / Constrained by Upstream Packages

Package	Current Version	Available	Reason Skipped
huggingface_hub	1.29.0	2.1.1 (Major)	Constrained by gradio_client 2.7.2 upstream compatibility range.
filelock	3.32.4	4.0.12 (Major)	Constrained by huggingface_hub (<4.0,>=3.10.0).
pyee	13.0.1	14.0.0 (Major)	Constrained by playwright 1.63.0 dependency requirement (<14,>=13).
pydantic_core	2.46.5	2.49.0 (Minor)	Exact pinned by pydantic 2.13.5 (pydantic-core==2.46.5).

Security Findings & Vulnerability Scan

• OSV Database Scan: Queried Open Source Vulnerability (OSV) API across all 36 installed packages. Result: 0 known vulnerabilities.
• GitHub Dependabot Scan: Queried repository pull requests and alerts. Result: 0 open Dependabot pull requests, 0 alerts.

Verification & Quality Gates

• Full Test Suite:
  • tests/test_grok.py, tests/test_janus.py, tests/test_api.py, tests/test_pipeline.py, tests/test_samples.py, tests/test_notify_discord.py, tests/test_proxies.py, tests/test_perchance.py: 78 / 78 passed (100% OK).
• Dependency Consistency: pip check reports No broken requirements found.