fix(deps): update Python security pins

.bumpversion.toml

@@ -1,5 +1,5 @@
 [tool.bumpversion]
-current_version = "1.19.3+260916"
+current_version = "1.19.4+261027"
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<patch>\\d+)\\+(?P<build>\\d+)"
 serialize = ["{major}.{minor}.{patch}+{build}"]
 search = "{current_version}"

.github/workflows/pull_request.yml

@@ -59,7 +59,7 @@ jobs:
       - name: Log in to Docker Hub
         uses: docker/login-action@v3
         with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          username: ${{ vars.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - uses: actions/checkout@v5 # v6 has a known bug https://github.com/orgs/community/discussions/183817
         with:
@@ -94,7 +94,7 @@ jobs:
       - name: Log in to Docker Hub
         uses: docker/login-action@v3
         with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          username: ${{ vars.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - uses: actions/checkout@v6
         with:

.pre-commit-config.yaml

@@ -73,7 +73,7 @@ repos:
         exclude: "poetry.lock|ui/pnpm-lock.yaml"
         args: [--baseline, .secrets.baseline]
   - repo: https://github.com/astral-sh/uv-pre-commit
-    rev: 0.11.9
+    rev: 0.13.6
     hooks:
       - id: uv-lock
   - repo: https://github.com/astral-sh/ruff-pre-commit

Dockerfile

@@ -2,9 +2,9 @@
 #############################################
 # Tox testsuite for multiple python version #
 #############################################
-FROM advian/tox-base:debian-trixie as tox
+FROM advian/tox-base:debian-trixie AS tox
 ARG PYTHON_VERSIONS="3.14 3.12"
-ARG UV_VERSION="0.11.6"
+ARG UV_VERSION="0.13.6"
 RUN export RESOLVED_VERSIONS=`pyenv_resolve $PYTHON_VERSIONS` \
     && echo RESOLVED_VERSIONS=$RESOLVED_VERSIONS \
     && for pyver in $RESOLVED_VERSIONS; do pyenv install -s $pyver; done \
@@ -37,8 +37,8 @@ RUN uv sync --frozen \
 ######################
 # Base builder image #
 ######################
-FROM python:3.14-trixie as builder_base
-COPY --from=ghcr.io/astral-sh/uv:0.11.6 /uv /uvx /usr/local/bin/
+FROM python:3.14-trixie AS builder_base
+COPY --from=ghcr.io/astral-sh/uv:0.13.6 /uv /uvx /usr/local/bin/
 
 ENV \
   # locale
@@ -96,7 +96,7 @@ RUN --mount=type=ssh uv venv /.venv \
 ####################################
 # Base stage for production builds #
 ####################################
-FROM builder_base as production_build
+FROM builder_base AS production_build
 # Copy entrypoint script
 COPY ./docker/entrypoint.sh /docker-entrypoint.sh
 COPY ./docker/container-init.sh /container-init.sh
@@ -117,7 +117,7 @@ RUN --mount=type=ssh source /.venv/bin/activate \
 #########################
 # Main production build #
 #########################
-FROM python:3.14-slim-trixie as production
+FROM python:3.14-slim-trixie AS production
 COPY --from=production_build /tmp/wheelhouse /tmp/wheelhouse
 COPY --from=production_build /docker-entrypoint.sh /docker-entrypoint.sh
 COPY --from=production_build /container-init.sh /container-init.sh
@@ -139,14 +139,14 @@ RUN --mount=type=ssh apt-get update && apt-get install -y \
     && true
 ENTRYPOINT ["/usr/bin/tini", "--", "/docker-entrypoint.sh"]
 
-FROM production as openapi
+FROM production AS openapi
 CMD ["rasenmaeher_api", "openapi"]
 
 
 #####################################
 # Base stage for development builds #
 #####################################
-FROM builder_base as devel_build
+FROM builder_base AS devel_build
 COPY . /app
 WORKDIR /app
 COPY ./docker/container-init.sh /container-init.sh
@@ -170,7 +170,7 @@ RUN --mount=type=ssh source /.venv/bin/activate \
 #0############
 # Run tests #
 #############
-FROM devel_build as test
+FROM devel_build AS test
 COPY . /app
 WORKDIR /app
 ENTRYPOINT ["/usr/bin/tini", "--", "docker/entrypoint-test.sh"]
@@ -184,7 +184,7 @@ RUN --mount=type=ssh source /.venv/bin/activate \
 ###########
 # Hacking #
 ###########
-FROM devel_build as devel_shell
+FROM devel_build AS devel_shell
 # Copy everything to the image
 COPY . /app
 WORKDIR /app

Dockerfile_pycharm

@@ -4,7 +4,7 @@
 #
 # Set python exectuable path to /.venv/bin/python
 ###
-FROM rasenmaeher_api:devel_shell as pycharm
+FROM rasenmaeher_api:devel_shell AS pycharm
 RUN source /root/.profile \
     && uv sync \
     && true

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "rasenmaeher_api"
-version = "1.19.3+260916"
+version = "1.19.4+261027"
 description = "python-rasenmaeher-api"
 authors = [
     { name = "Aciid", email = "703382+Aciid@users.noreply.github.com" },
@@ -12,7 +12,7 @@ requires-python = ">=3.12,<4.0"
 dependencies = [
     "libadvian>=1.6,<2.0",
     "click>=8.0,<9.0",
-    "cryptography>=46.0.5",
+    "cryptography>=50.0.2",
     "fastapi>=0.89,<1.0",
     "pydantic>=2.0,<3.0",
     "pydantic-settings>=2.0,<3.0",
@@ -27,7 +27,7 @@ dependencies = [
     "aiodns>=3.0,<4.0",
     "brotli>=1.0,<2.0",
     "cchardet>=2.1,<3.0; python_version<='3.10'",
-    "filelock>=3.12,<4.0",
+    "filelock>=4.2.4,<5.0",
     "python-keycloak>=4.2.0,<5.0",
     "sqlmodel>=0.0.37,<1.0",
     "psycopg2-binary>=2.9,<3.0",

src/rasenmaeher_api/__init__.py

@@ -1,3 +1,3 @@
 """python-rasenmaeher-api"""
 
-__version__ = "1.19.3+260916"  # NOTE Use `bump-my-version` to bump versions correctly
+__version__ = "1.19.4+261027"  # NOTE Use `bump-my-version` to bump versions correctly

tests/conftest.py

@@ -164,7 +164,7 @@ def session_env_config(
         # Apparently we are too late in setting the env for settings to take effect
         mpatch.setattr(switchme_to_singleton_call, "integration_api_timeout", 6.0)
         mpatch.setenv("RM_INTEGRATION_API_TIMEOUT", str(switchme_to_singleton_call.integration_api_timeout))
-        mpatch.setattr(switchme_to_singleton_call, "cfssl_timeout", 5.0)
+        mpatch.setattr(switchme_to_singleton_call, "cfssl_timeout", 65.0)
         mpatch.setenv("RM_CFSSL_TIMEOUT", str(switchme_to_singleton_call.cfssl_timeout))
         mpatch.setattr(switchme_to_singleton_call, "cfssl_port", docker_services.port_for("cfssl", 7777))
         mpatch.setenv("RM_CFSSL_PORT", str(switchme_to_singleton_call.cfssl_port))

tests/ptfpapi/Dockerfile

@@ -1,18 +1,18 @@
 # syntax=docker/dockerfile:1.1.7-experimental
-FROM python:3.14-trixie as base
+FROM python:3.14-trixie AS base
 COPY requirements.txt /pysetup/
 RUN pip3 install -r /pysetup/requirements.txt
 
 
-FROM base as init
+FROM base AS init
 COPY fpinit.py /app/
 ENTRYPOINT ["python3", "/app/fpinit.py" ]
 
 
-FROM base as run
+FROM base AS run
 COPY fprun.py /app/
 ENTRYPOINT ["python3", "/app/fprun.py" ]
 
-FROM base as client
+FROM base AS client
 COPY fpclient.py fpclient_entrypoint.sh /app/
 ENTRYPOINT ["/app/fpclient_entrypoint.sh"]

tests/test_rasenmaeher_api.py

@@ -15,7 +15,7 @@
 
 def test_version() -> None:
     """Make sure version matches expected"""
-    assert __version__ == "1.19.3+260916"
+    assert __version__ == "1.19.4+261027"
 
 
 @pytest.mark.asyncio(loop_scope="session")