security: force urllib3==2.6.3 to patch CVE-2026-21441

This update mitigates the decompression bomb vulnerability discovered in the streaming API. Also upgraded transitive dependencies including pydantic, aiohttp, and authlib to latest stable versions.

Author: 1minds3t

requirements.txt

@@ -6,45 +6,54 @@
 #
 aiohappyeyeballs==2.6.1
     # via aiohttp
-aiohttp==3.13.1 ; python_version >= "3.9"
+aiohttp==3.13.3 ; python_version >= "3.9"
     # via omnipkg (pyproject.toml)
 aiosignal==1.4.0
     # via aiohttp
 annotated-types==0.7.0
     # via pydantic
-anyio==4.10.0
+anyio==4.12.1
     # via httpx
-attrs==25.3.0
+attrs==25.4.0
     # via aiohttp
-authlib==1.6.5 ; python_version >= "3.7"
+authlib==1.6.6 ; python_version >= "3.9"
     # via
     #   omnipkg (pyproject.toml)
     #   safety
-certifi==2025.8.3
+blinker==1.9.0
+    # via flask
+certifi==2026.1.4
     # via
     #   httpcore
     #   httpx
     #   requests
 cffi==2.0.0
     # via cryptography
-charset-normalizer==3.4.3
+charset-normalizer==3.4.4
     # via requests
-click==8.3.0
+click==8.3.1
     # via
+    #   flask
     #   nltk
     #   safety
     #   typer
-cryptography==46.0.1
+cryptography==46.0.3
     # via authlib
 dparse==0.6.4
     # via
     #   safety
     #   safety-schemas
-filelock==3.20.1 ; python_version >= "3.10"
+filelock==3.20.2 ; python_version >= "3.10"
     # via
     #   omnipkg (pyproject.toml)
     #   safety
-frozenlist==1.7.0
+flask==3.1.2 ; python_version >= "3.8"
+    # via
+    #   flask-cors
+    #   omnipkg (pyproject.toml)
+flask-cors==6.0.2 ; python_version >= "3.8"
+    # via omnipkg (pyproject.toml)
+frozenlist==1.8.0
     # via
     #   aiohttp
     #   aiosignal
@@ -54,85 +63,88 @@ httpcore==1.0.9
     # via httpx
 httpx==0.28.1
     # via safety
-idna==3.10
+idna==3.11
     # via
     #   anyio
     #   httpx
     #   requests
     #   yarl
+itsdangerous==2.2.0
+    # via flask
 jinja2==3.1.6
-    # via safety
-joblib==1.5.2
+    # via
+    #   flask
+    #   safety
+joblib==1.5.3
     # via nltk
 markdown-it-py==4.0.0
     # via rich
-markupsafe==3.0.2
-    # via jinja2
-marshmallow==4.1.2 ; python_version >= "3.10"
+markupsafe==3.0.3
+    # via
+    #   flask
+    #   jinja2
+    #   werkzeug
+marshmallow==4.2.0 ; python_version >= "3.10"
     # via
     #   omnipkg (pyproject.toml)
     #   safety
 mdurl==0.1.2
     # via markdown-it-py
-multidict==6.6.4
+multidict==6.7.0
     # via
     #   aiohttp
     #   yarl
-nltk==3.9.1
+nltk==3.9.2
     # via safety
 packaging==25.0 ; python_version >= "3.10"
     # via
     #   dparse
     #   omnipkg (pyproject.toml)
     #   safety
     #   safety-schemas
-propcache==0.3.2
+propcache==0.4.1
     # via
     #   aiohttp
     #   yarl
-psutil==7.1.0
+psutil==7.2.1
     # via omnipkg (pyproject.toml)
 pycparser==2.23
     # via cffi
-pydantic==2.9.2
+pydantic==2.12.5
     # via
     #   safety
     #   safety-schemas
-pydantic-core==2.23.4
+pydantic-core==2.41.5
     # via pydantic
 pygments==2.19.2
     # via rich
-regex==2025.9.18
+regex==2025.11.3
     # via nltk
 requests==2.32.5
     # via
     #   omnipkg (pyproject.toml)
     #   safety
-rich==14.1.0
+rich==14.2.0
     # via
     #   omnipkg (pyproject.toml)
     #   typer
-ruamel-yaml==0.18.15
+ruamel-yaml==0.19.1
     # via
     #   safety
     #   safety-schemas
-ruamel-yaml-clib==0.2.14
-    # via ruamel-yaml
 safety==3.7.0 ; python_version >= "3.10" and python_version < "3.14"
     # via omnipkg (pyproject.toml)
 safety-schemas==0.0.16
     # via safety
 shellingham==1.5.4
     # via typer
-sniffio==1.3.1
-    # via anyio
 tenacity==9.1.2
     # via safety
 tomlkit==0.13.3
     # via safety
 tqdm==4.67.1
     # via nltk
-typer==0.19.1
+typer==0.21.1
     # via
     #   omnipkg (pyproject.toml)
     #   safety
@@ -145,9 +157,20 @@ typing-extensions==4.15.0
     #   safety
     #   safety-schemas
     #   typer
-urllib3==2.6.0
-    # via requests
-uv==0.9.6 ; python_version >= "3.8"
+    #   typing-inspection
+typing-inspection==0.4.2
+    # via pydantic
+urllib3==2.6.3
+    # via
+    #   requests
+    #   urllib3-lts
+urllib3-lts==2025.66471.3
+    # via omnipkg (pyproject.toml)
+uv==0.9.22 ; python_version >= "3.8"
     # via omnipkg (pyproject.toml)
-yarl==1.20.1
+werkzeug==3.1.4
+    # via
+    #   flask
+    #   flask-cors
+yarl==1.22.0
     # via aiohttp