@cryptotaxi247 / CoPilot / commits / b5f2f5e2

chore: tier 1 python dep upgrades — safe drop-ins within current majors (#844)

Re-runs pip-compile against requirements.in and bumps every package that has a clean drop-in upgrade within its current major version. Major version upgrades that require code changes (pydantic 1→2, SQLAlchemy 1.4→2.0, bcrypt 4→5, cryptography 41→42+ which removed deprecated APIs, environs 9→15, grafana-client 3→5, aiofiles 23→25, fastapi 0.116+ which drops py3.9, xmltodict 0→1) are deliberately held back via upper-bound pins in requirements.in. Bumped (26 top-level + many transitives): apscheduler 3.10.4 → 3.11.2 aiohttp 3.8.5 → 3.13.5 aiomysql 0.2.0 → 0.3.2 aiosqlite 0.19.0 → 0.22.1 alembic 1.13.1 → 1.18.4 asyncgelf 1.1.0 → 1.2.0 bcrypt 4.0.1 → 4.3.0 (held <5) cryptography 41.0.4 → 41.0.7 (held <42) docxtpl 0.18.0 → 0.20.2 fastapi 0.103.2 → 0.115.14 (held <0.116) grafana-client 3.10.0 → 3.11.2 (held <4) httpx[http2] 0.25.0 → 0.28.1 (held <0.29) influxdb-client 1.38.0 → 1.50.0 Jinja2 3.1.2 → 3.1.6 loguru 0.7.2 → 0.7.3 miniopy-async 1.21.1 → 1.23.5 playwright 1.39.0 → 1.59.0 (chromium 119 → headless 147) pydantic[email] 1.10.x → 1.10.26 (held <2) PyJWT 2.8.0 → 2.12.1 PyMySQL 1.1.0 → 1.1.3 python-dotenv 1.0.0 → 1.2.2 python-multipart 0.0.6 → 0.0.27 (held <1) PyYAML 6.0.1 → 6.0.3 pyvelociraptor 0.1.8 → 0.1.9 qrcode 7.4.2 → 8.2 regex 2023.10 → 2026.4 requests 2.33.0 → 2.33.1 SQLAlchemy 1.4.41 → 1.4.54 (held <2) sqlmodel 0.0.8 → 0.0.9 (held <0.0.10 — 0.0.10+ pulls SQLAlchemy 2) starlette 0.27.0 → 0.46.2 (transitive of fastapi) uvicorn[standard] 0.23.2 → 0.46.0 werkzeug 3.0.0 → 3.1.8 xmltodict 0.13.0 → 0.15.1 (held <1) Held at current version (not in this PR's scope): - pydantic 1 → 2 : 29 @validator + 44 class Config sites in app/ - SQLAlchemy 1.4 → 2.0 : 142 AsyncSession sites in app/ - bcrypt 4 → 5 : passlib 1.7.4 may not support bcrypt 5 - cryptography 41 → 42+ : deprecated-API removals - environs 9 → 15 : major API changes - grafana-client 3 → 5 : major - aiofiles 23 → 25 : major - xmltodict 0 → 1 : pre-1.0 to 1.0 may break Held for build environment reasons: - grpcio / grpcio-tools 1.59.0 — newer pre-built wheels intermittently fail with `ModuleNotFoundError: pkg_resources` under setuptools 81+ during pip-compile. Worth a follow-up PR to migrate to newer grpcio after fixing the build env. Compatibility pin added: - marshmallow<4 — environs 9.5.0 reads marshmallow.__version_info__, which marshmallow 4.x removed. Caught at boot time during the test deploy; pin holds marshmallow at 3.26.2 (latest 3.x). Verified locally: - docker build of backend/Dockerfile succeeds (image: 1.08 GB) - backend boots cleanly: alembic upgrade head runs, all seed funcs complete, "Application startup complete" + "Scheduler started" in logs - all ~50 routers import without ModuleNotFoundError - `from playwright.async_api import async_playwright` succeeds (Grafana reporting path) - existing MySQL data unchanged across the rebuild - `GET /` returns HTTP 200 Co-authored-by: taylor_socfortress <taylor.walton@socfortress.co> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

taylorcopilot committed May 7, 2026 at 18:11 UTC b5f2f5e2576d0cd49a04f8cc662468f2132f6ec8
2 files changed +200 -177
backend/requirements.in
+15 -13
@@ -1,45 +1,47 @@
1 -aiofiles
1 +aiofiles<24
2 aiohttp
3 aiomysql
4 aiosqlite
5 alembic
6 apscheduler
7 asyncgelf
8 -bcrypt
8 +bcrypt<5
9 cortex4py
10 -cryptography
10 +cryptography<42
11 docxtpl
12 elasticsearch7==7.10.1
13 -environs
14 -fastapi
15 -grafana-client
16 -grpcio
17 -httpx[http2]
13 +environs<10
14 +fastapi<0.116
15 +grafana-client<4
16 +grpcio==1.59.0
17 +grpcio-tools==1.59.0
18 +httpx[http2]<0.29
19 influxdb-client[async]
20 Jinja2
21 loguru
22 +marshmallow<4
23 miniopy-async
24 packaging
25 passlib
26 passlib[bcrypt]
27 pdfkit
28 playwright
27 -pydantic[email]
29 +pydantic[email]<2
30 PyJWT
31 PyMySQL
32 pyotp
33 python-dotenv
34 python-magic
33 -python-multipart
35 +python-multipart<1
36 pyvelociraptor~=0.1
37 PyYAML
38 qrcode
39 regex
40 requests
41 ScoutSuite
40 -SQLAlchemy
41 -sqlmodel
42 +SQLAlchemy<2
43 +sqlmodel<0.0.10
44 starlette
45 uvicorn[standard]
46 werkzeug
45 -xmltodict
47 +xmltodict<1
backend/requirements.txt
+185 -164
@@ -1,177 +1,198 @@
1 -aiocsv==1.2.5
1 +aiocsv==1.4.0
2 aiofiles==23.2.1
3 -aiohttp==3.8.5
4 -aiomysql==0.2.0
5 -aiosignal==1.3.1
6 -aiosqlite==0.19.0
7 -alembic==1.13.1
8 -amqp==5.1.1
9 -annotated-types==0.6.0
10 -antlr4-python3-runtime==4.9.3
11 -anyio==3.7.1
12 -appdirs==1.4.4
13 -APScheduler==3.10.4
14 -arrow==1.3.0
15 -async-timeout==4.0.3
16 -asyncgelf==1.1.0
17 -attrs==23.1.0
18 -bcrypt==4.0.1
19 -billiard==4.1.0
20 -cattrs==23.1.2
21 -#celery==5.3.4 removed due to python-dateutils==2.8.0 and i dont think we need this anyways
22 -certifi==2023.7.22
23 -cffi==1.16.0
24 -charset-normalizer==3.3.0
25 -click==8.1.7
26 -click-didyoumean==0.3.0
27 -click-plugins==1.1.1
28 -click-repl==0.3.0
29 -colorama==0.4.6
30 -colour==0.1.5
31 -contourpy==1.1.1
3 +aiohappyeyeballs==2.6.1
4 +aiohttp==3.13.5
5 +aiohttp-retry==2.9.1
6 +aiomysql==0.3.2
7 +aiosignal==1.4.0
8 +aiosqlite==0.22.1
9 +alembic==1.18.4
10 +aliyun-python-sdk-actiontrail==2.2.0
11 +aliyun-python-sdk-core==2.16.0
12 +aliyun-python-sdk-ecs==4.24.82
13 +aliyun-python-sdk-kms==2.16.5
14 +aliyun-python-sdk-ocs==0.0.4
15 +aliyun-python-sdk-ram==3.3.1
16 +aliyun-python-sdk-rds==2.7.53
17 +aliyun-python-sdk-sts==3.1.3
18 +aliyun-python-sdk-vpc==3.0.48
19 +annotated-doc==0.0.4
20 +anyio==4.13.0
21 +apscheduler==3.11.2
22 +argon2-cffi==23.1.0
23 +argon2-cffi-bindings==25.1.0
24 +asyncgelf==1.2.0
25 +asyncio==4.0.0
26 +asyncio-throttle==0.1.1
27 +attrs==26.1.0
28 +azure-common==1.1.28
29 +azure-core==1.40.0
30 +azure-identity==1.5.0
31 +azure-mgmt-authorization==3.0.0
32 +azure-mgmt-compute==18.2.0
33 +azure-mgmt-core==1.6.0
34 +azure-mgmt-keyvault==8.0.0
35 +azure-mgmt-monitor==2.0.0
36 +azure-mgmt-network==17.1.0
37 +azure-mgmt-rdbms==8.0.0
38 +azure-mgmt-redis==12.0.0
39 +azure-mgmt-resource==15.0.0
40 +azure-mgmt-security==1.0.0
41 +azure-mgmt-sql==1.0.0
42 +azure-mgmt-storage==17.0.0
43 +azure-mgmt-web==1.0.0
44 +backports-tarfile==1.2.0
45 +bcrypt==4.3.0
46 +boto3==1.43.5
47 +botocore==1.43.5
48 +cachetools==4.2.4
49 +certifi==2025.11.12
50 +cffi==2.0.0
51 +charset-normalizer==3.4.7
52 +cheroot==11.1.2
53 +cherrypy==18.10.0
54 +cherrypy-cors==1.7.0
55 +circuitbreaker==2.1.3
56 +click==8.3.3
57 +coloredlogs==10.0
58 cortex4py==2.1.0
33 -cpe==1.2.1
34 -cryptography==41.0.4
35 -cybox==2.1.0.21
36 -cycler==0.12.0
37 -deepdiff==6.5.0
38 -Deprecated==1.2.14
39 -dnspython==2.4.2
40 -docxtpl==0.18.0
41 -drawsvg==2.3.0
59 +crcmod==1.7
60 +cryptography==41.0.7
61 +dnspython==2.8.0
62 +docxtpl==0.20.2
63 +durationpy==0.10
64 elasticsearch7==7.10.1
43 -email-validator==2.0.0.post2
65 +email-validator==2.3.0
66 environs==9.5.0
45 -et-xmlfile==1.1.0
46 -fastapi==0.103.2
47 -fonttools==4.43.0
48 -fqdn==1.5.1
49 -frozenlist==1.4.0
50 -grafana-client==3.10.0
51 -greenlet==3.0.0
67 +fastapi==0.115.14
68 +frozenlist==1.8.0
69 +google-api-core[grpc]==1.31.5
70 +google-api-python-client==2.196.0
71 +google-auth==1.35.0
72 +google-auth-httplib2==0.4.0
73 +google-cloud-appengine-logging==1.1.6
74 +google-cloud-audit-log==0.5.0
75 +google-cloud-container==2.10.7
76 +google-cloud-core==2.3.1
77 +google-cloud-iam==2.6.1
78 +google-cloud-kms==1.3.0
79 +google-cloud-logging==3.1.1
80 +google-cloud-monitoring==1.1.0
81 +google-cloud-resource-manager==1.5.0
82 +google-cloud-storage==2.11.0
83 +google-crc32c==1.8.0
84 +google-resumable-media==2.9.0
85 +googleapis-common-protos[grpc]==1.75.0
86 +grafana-client==3.11.2
87 +greenlet==3.5.0
88 +grpc-google-iam-v1==0.12.7
89 grpcio==1.59.0
90 grpcio-tools==1.59.0
54 -h11==0.14.0
55 -httpcore==0.18.0
56 -httptools==0.6.1
57 -httpx==0.25.0
58 -httpx[http2]==0.25.0
59 -idna==3.4
60 -influxdb-client==1.38.0
61 -isoduration==20.11.0
62 -itsdangerous==2.1.2
63 -Jinja2==3.1.2
64 -Jinja2==3.1.2
65 -jsonpointer==2.4
66 -jsonschema==4.17.3
67 -kiwisolver==1.4.5
68 -kombu==5.3.2
69 -licensing==0.43
70 -loguru==0.7.2
71 -#lxml==4.9.3 Bump down for python-docx
72 -lxml==4.9.2
73 -maec==4.1.0.17
74 -Markdown==3.4.4
75 -markdown-it-py==3.0.0
76 -MarkupSafe==2.1.3
77 -marshmallow==3.20.1
91 +h11==0.16.0
92 +h2==4.3.0
93 +hpack==4.1.0
94 +httpagentparser==1.9.9
95 +httpcore==1.0.9
96 +httplib2==0.31.2
97 +httplib2shim==0.0.3
98 +httptools==0.7.1
99 +httpx[http2]==0.28.1
100 +humanfriendly==10.0
101 +hyperframe==6.1.0
102 +idna==3.13
103 +influxdb-client[async]==1.50.0
104 +isodate==0.7.2
105 +jaraco-collections==5.2.1
106 +jaraco-context==6.1.2
107 +jaraco-functools==4.4.0
108 +jaraco-text==4.2.0
109 +jinja2==3.1.6
110 +jmespath==0.10.0
111 +kubernetes==35.0.0
112 +loguru==0.7.3
113 +lxml==6.1.0
114 +mako==1.3.12
115 +markdown-it-py==4.2.0
116 +markupsafe==3.0.3
117 +marshmallow==3.26.2
118 mdurl==0.1.2
79 -miniopy-async==1.21.1
80 -#mitreattack-python==2.0.14
81 -mixbox==1.0.5
82 -multidict==6.0.4
83 -netaddr==0.9.0
84 -numpy==1.26.0
85 -openpyxl==3.1.2
86 -ordered-set==4.1.0
87 -orjson==3.9.9
88 -#packaging==23.2
89 -packaging>=24.1,<25.0
90 -#pandas==2.1.1 Had to drop to 1.3.5 which is compatible with python-dateutils==2.8.0 which is required by scoutsuite
91 -#pandas==1.3.5
92 -passlib==1.7.4
119 +miniopy-async==1.23.5
120 +more-itertools==11.0.2
121 +msal==1.36.0
122 +msal-extensions==0.3.1
123 +msgraph-core==0.2.2
124 +msrest==0.7.1
125 +multidict==6.7.1
126 +netaddr==1.3.0
127 +oauth2client==4.1.3
128 +oauthlib==3.3.1
129 +oci==2.168.1
130 +oss2==2.19.1
131 +packaging==26.2
132 +passlib[bcrypt]==1.7.4
133 pdfkit==1.0.0
94 -Pillow==10.0.1
95 -pip==22.3.1
96 -platformdirs==3.11.0
97 -playwright==1.39.0
98 -pluralizer==1.2.0
99 -pooch==1.7.0
100 -prompt-toolkit==3.0.39
101 -protobuf==4.24.4
102 -pyasn1==0.5.0
103 -pycountry==22.3.5
104 -pycparser==2.21
105 -# pydantic==1.10.13
106 -# pydantic_core==2.10.1
107 -# pydantic-extra-types==2.1.0
108 -# pydantic-settings==2.0.3
109 -pyee==11.0.1
110 -Pygments==2.16.1
111 -PyJWT==2.8.0
112 -PyMySQL==1.1.0
134 +playwright==1.59.0
135 +policyuniverse==1.5.1.20231109
136 +portalocker==2.10.1
137 +portend==3.2.1
138 +propcache==0.4.1
139 +proto-plus==1.28.0
140 +protobuf==4.25.9
141 +pyasn1==0.6.3
142 +pyasn1-modules==0.4.2
143 +pycparser==3.0
144 +pycryptodome==3.23.0
145 +pydantic[email]==1.10.26
146 +pydo==0.34.0
147 +pyee==13.0.1
148 +pygments==2.20.0
149 +pyjwt[crypto]==2.12.1
150 +pymysql==1.1.3
151 +pyopenssl==25.1.0
152 pyotp==2.9.0
114 -pyparsing==3.1.1
115 -pyrsistent==0.19.3
116 -pySigma==0.11.9
153 +pyparsing==3.3.2
154 python-dateutil==2.8.0
118 -python-dotenv==1.0.0
155 +python-docx==1.2.0
156 +python-dotenv==1.2.2
157 python-magic==0.4.27
120 -python-multipart==0.0.6
121 -pytz==2023.3.post1
122 -pyvelociraptor==0.1.8
123 -PyYAML==6.0.1
124 -qrcode==7.4.2
125 -reactivex==4.0.4
126 -redis==4.6.0
127 -regex==2023.10.3
128 -requests==2.33.0
129 -requests-cache==1.1.0
130 -rfc3339-validator==0.1.4
131 -rfc3986-validator==0.1.1
132 -rich==13.6.0
133 -rsa==4.9
134 -ScoutSuite==5.14.0
135 -setuptools==65.5.0
136 -shufflepy==0.1.8
137 -simplejson==3.19.1
138 -singul==0.1.8
139 -six==1.16.0
140 -sniffio==1.3.0
141 -SQLAlchemy==1.4.41
142 -sqlalchemy2-stubs==0.0.2a35
143 -sqlmodel==0.0.8
144 -starlette==0.27.0
145 -stix==1.2.0.11
146 -stix2==3.0.1
147 -stix2-elevator==4.1.7
148 -stix2-patterns==2.0.0
149 -stix2-validator==3.1.4
150 -stixmarx==1.0.8
151 -tabulate==0.9.0
152 -taxii2-client==2.3.0
153 -tqdm==4.66.1
154 -typer==0.9.0
155 -types-python-dateutil==2.8.19.14
158 +python-multipart==0.0.27
159 +pytz==2026.2
160 +pyvelociraptor==0.1.9
161 +pyyaml==6.0.3
162 +qrcode==8.2
163 +reactivex==4.1.0
164 +regex==2026.4.4
165 +requests==2.33.1
166 +requests-oauthlib==2.0.0
167 +rich==15.0.0
168 +rsa==4.9.1
169 +s3transfer==0.17.0
170 +scoutsuite==5.14.0
171 +shellingham==1.5.4
172 +six==1.17.0
173 +sqlalchemy==1.4.54
174 +sqlalchemy2-stubs==0.0.2a38
175 +sqlitedict==2.1.0
176 +sqlmodel==0.0.9
177 +starlette==0.46.2
178 +tempora==5.9.0
179 +typer==0.25.1
180 +typer-slim==0.24.0
181 typing==3.7.4.3
157 -#typing_extensions==4.8.0 Bump to 4.9.0
158 -typing_extensions==4.9.0
159 -tzdata==2023.3
160 -tzlocal==5.2
161 -ujson==5.8.0
162 -uri-template==1.3.0
163 -url-normalize==1.4.3
164 -urllib3==1.26.17
165 -uvicorn==0.23.2
182 +typing-extensions==4.15.0
183 +tzlocal==5.3.1
184 +uritemplate==4.2.0
185 +urllib3==1.26.20
186 +uvicorn[standard]==0.46.0
187 +uvloop==0.22.1
188 verlib2==0.2.0
167 -vine==5.1.0
168 -watchfiles==0.21.0
169 -wcwidth==0.2.9
170 -weakrefmethod==1.0.3
171 -webcolors==1.13
172 -websockets==11.0.3
173 -Werkzeug==3.0.0
174 -wrapt==1.15.0
175 -XlsxWriter==3.1.6
176 -xmltodict==0.13.0
177 -yarl==1.9.2
189 +watchfiles==1.1.1
190 +websocket-client==1.9.0
191 +websockets==16.0
192 +werkzeug==3.1.8
193 +xmltodict==0.15.1
194 +yarl==1.23.0
195 +zc-lockfile==4.0
196 +
197 +# The following packages are considered to be unsafe in a requirements file:
198 +# setuptools