fix(requirements): update pyotp version to 2.9.1

[JairHan]

Modifications / 改动点

• This is NOT a breaking change. / 这不是一个破坏性变更。

Screenshots or Test Results / 运行截图或测试结果

---

Checklist / 检查清单

• 😊 If there are new features added in the PR, I have discussed it with the authors through issues/emails, etc.
  / 如果 PR 中有新加入的功能，已经通过 Issue / 邮件等方式和作者讨论过。

• 👀 My changes have been well-tested, and "Verification Steps" and "Screenshots" have been provided above.
  / 我的更改经过了良好的测试，并已在上方提供了“验证步骤”和“运行截图”。

• 🤓 I have ensured that no new dependencies are introduced, OR if new dependencies are introduced, they have been added to the appropriate locations in requirements.txt and pyproject.toml.
  / 我确保没有引入新依赖库，或者引入了新依赖库的同时将其添加到 requirements.txt 和 pyproject.toml 文件相应位置。

• 😮 My changes do not introduce malicious code.
  / 我的更改没有引入恶意代码。

[Copilot]

Copilot wasn't able to review any files in this pull request.

[gemini-code-assist]

Code Review

This pull request updates the dependency pyotp from version >=2.9.0 to >=2.9.1 in requirements.txt. There are no review comments, and I have no additional feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[Ilyasslamti]

[Security Architecture Review] - Critical Supply Chain Risk (Floating Dependencies)

Hi @JairHan,

From an Enterprise Security and Threat Intelligence perspective, this PR cannot be merged as is. While updating pyotp is necessary, using >=2.9.1 in requirements.txt introduces a severe non-deterministic build vulnerability.

Security Implications:
pyotp is a core security library handling 2FA/MFA. By allowing floating versions (>=), you are authorizing the CI/CD pipeline to automatically fetch any future versions (e.g., 2.9.2 or 3.0.x). If the upstream package on PyPI is compromised via a supply chain attack or account hijacking, our infrastructure will automatically deploy the malicious payload without any human oversight or CI warnings. The automated LLM bot reviews completely missed this vector.

Required Action for Approval:

1. Strict Pinning: You must explicitly lock the version to pyotp==2.9.1.
2. Integrity Check: Ensure no other floating versions are introduced.

Please update the target line in requirements.txt to:
pyotp==2.9.1