[TFT444]

Summary

• Pin vulnerable transitive Python dependencies explicitly in requirements.in and regenerate all three lock files to clear pip-audit SCA failures that were blocking the entire PR queue.
• aiohttp 3.14.3 → 3.14.5: fixes HIGH file descriptor exhaustion, memory exhaustion, missing timeout, request smuggling and cookie scope CVEs
• multidict 6.8.0 → 7.2.1: fixes MEDIUM reference leak in CIMultiDict
• mako 1.4.1 → 1.4.3: fixes MEDIUM path traversal on Windows via drive-letter URI
• werkzeug 3.1.8 → 3.1.9: keeps at latest; already pinned in previous fix, now in requirements.in as an explicit guard

Why requirements.in

These are transitive dependencies pulled in by Flask and SQLAlchemy. Without explicit pins in requirements.in, pip-audit flags them on every CI run, blocking unrelated PRs. Pins are placed at the bottom of requirements.in with a comment.

Lock file regeneration

Regenerated via scripts/lock_dependencies.py using Python 3.11 on Linux (pip-tools 7.6.1, pip 26.2.1) as required by the project's lock script.

Test plan

• CI pip-audit step passes on this branch
• pip install -r requirements.txt produces no audit warnings for the four pinned packages
• Existing test suite passes (no functional code changes)

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
pip/aiohttp	3.14.5	Unknown	Unknown
pip/certifi	2026.10.23	🟢 6.5	Details Check Score Reason Code-Review 🟢 6 Found 4/6 approved changesets -- score normalized to 6 Security-Policy 🟢 10 security policy file detected Binary-Artifacts 🟢 10 no binaries found in the repo Maintained 🟢 8 8 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 8 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Pinned-Dependencies 🟢 5 dependency not pinned by hash detected -- score normalized to 5 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 9 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Packaging 🟢 10 packaging workflow detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
pip/mako	1.4.3	Unknown	Unknown
pip/multidict	7.2.1	Unknown	Unknown
pip/werkzeug	3.1.9	Unknown	Unknown

Scanned Files

• requirements.txt

[parthrohit22]

Re-reviewed c2a22d0. The lock changes are only versions and hashes for aiohttp, multidict, mako, werkzeug and certifi. Nothing else moved, and CI is green. Approving. Please merge this first, so the other PRs can drop their duplicate dependency edits and rebase onto it.

Two non-blocking notes:

multidict goes up a major version (6.8.0 → 7.2.1). OWASP/openshield#392 fixed the same CVE with 6.9.1. If 7.x isn’t needed for anything else, the smaller bump is lower risk.
Exact == pins on indirect dependencies in requirements.in will need manual bumps from now on. Lower bounds like >= would let the lock script handle them.