[ROMzombie]

Dependency Update and Security Review (2026-10-11)

Summary of Updates

This PR reviews project dependencies, scans for known security vulnerabilities and outdated versions, upgrades compatible direct and transitive dependencies to their latest safe minor and patch releases, and verifies the full test suite.

Dependency Audit

Direct Dependencies (requirements.txt)

Package	Previous Pin	Upgraded Pin	Installed Version	Category	Security Status
fastapi	>=0.142.2	>=0.143.0	0.143.0	Minor (Safe)	0 CVEs
pydantic	>=2.13.5	>=2.14.1	2.14.1	Minor (Safe)	0 CVEs
uvicorn[standard]	>=0.54.0	>=0.54.0	0.54.0	Up to date	0 CVEs
httpx	>=0.28.1	>=0.28.1	0.28.1	Up to date	0 CVEs
pillow	>=12.3.0	>=12.3.0	12.3.0	Up to date	0 CVEs
python-multipart	>=0.0.32	>=0.0.32	0.0.32	Up to date	0 CVEs
playwright	>=1.63.0	>=1.63.0	1.63.0	Up to date	0 CVEs
gradio_client	>=2.7.2	>=2.7.2	2.7.2	Up to date	0 CVEs
python-dotenv	>=1.2.4	>=1.2.4	1.2.4	Up to date	0 CVEs

Transitive Dependencies Upgraded (Safe Minor/Patch)

Package	Previous Version	Upgraded Version	Category	Dependency Of
pydantic-core	2.46.5	2.50.1	Minor (Safe)	pydantic
httptools	0.8.0	0.9.0	Minor (Safe)	uvicorn[standard]
opentelemetry-api	1.45.0	1.45.1	Patch (Safe)	fastapi
hf-xet	1.6.0	1.7.0	Minor (Safe)	huggingface-hub

Upgrades Skipped / Constrained by Upstream Packages

Package	Current Version	Available	Reason Skipped
huggingface_hub	1.29.0	2.2.0 (Major)	Major v2.0 release replaces internal HTTP transport with httpx2, introducing breaking changes with gradio_client 2.7.2.
filelock	3.32.4	4.1.1 (Major)	Constrained by huggingface_hub 1.x compatibility.
pyee	13.0.1	14.0.0 (Major)	Constrained by playwright 1.63.0 requirement (pyee<14,>=13).

Security Findings & Vulnerability Scan

• OSV Database Scan: Queried Open Source Vulnerability (OSV) API across all 36 installed packages. Result: 0 known vulnerabilities.
• GitHub Dependabot Scan: Queried repository pull requests and alerts. Result: 0 open Dependabot pull requests, 0 alerts.

Verification & Quality Gates

• Full Test Suite:
  • tests/test_grok.py, tests/test_janus.py, tests/test_api.py, tests/test_pipeline.py, tests/test_samples.py, tests/test_notify_discord.py, tests/test_proxies.py, tests/test_perchance.py: 78 / 78 passed (100% OK).
• Dependency Consistency: pip check reports No broken requirements found.