fix: resolve dependabot alerts (#2094)

* fix: resolve dependabot alerts

* fix: bump click, httplib2, setuptools to patched versions

Author: sricharan-varanasi

pyproject.toml

@@ -9,26 +9,26 @@ dependencies = [
   # Run `uv sync --upgrade-package foo` to upgrade indirect dependencies
   "aio-pika==9.5.*",
   "aiofiles~=24.1.0",
-  "aiohttp>=3.13.4",
+  "aiohttp>=3.14.1",
   "alembic~=1.16.1",
   "asgi-correlation-id~=4.3.4",
   "asyncpg~=0.30.0",
   "azure-storage-blob==12.25.*",
   "bcrypt~=4.3.0",
   "boto3~=1.40.60",
-  "cryptography>=46.0.7",
+  "cryptography>=48.0.1",
   "ddtrace~=3.17.1",
-  "fastapi==0.124.*",
-  "fastapi-mail>=1.5.3",
+  "fastapi>=0.136.0",
+  "fastapi-mail>=1.6.3",
   "firebase-admin==6.9.*",
   "httpx==0.28.*",
   "jinja2==3.1.*",
   "nh3==0.3.*",
   "pydantic[email]>=2.0",
-  "pyjwt>=2.12.0",
+  "pyjwt>=2.13.0",
   "pymongo==4.13.0",
   "pyotp~=2.9.0",
-  "python-multipart>=0.0.26",
+  "python-multipart>=0.0.31",
   "python-slugify==8.0.4",
   "redis==5.2.*",
   "sentry-sdk~=2.13",

src/apps/shared/test/client.py

@@ -28,6 +28,23 @@ def _get_updated_headers(self, headers: dict | None = None) -> dict:
             headers_.update(headers)
         return headers_
 
+    def _get_json_headers(
+        self,
+        headers: dict | None = None,
+        body: str | None = None,
+        files: Mapping[str, BytesIO] | None = None,
+    ) -> dict:
+        """Headers for a request whose body is serialized JSON.
+
+        The body is passed to httpx as raw ``content``, so the JSON content type has to be set
+        explicitly - Starlette will not parse the body into the endpoint's model without it.
+        Skipped for multipart requests and when the caller sets the header itself.
+        """
+        headers_ = self._get_updated_headers(headers)
+        if body is not None and not files and not any(k.lower() == "content-type" for k in headers_):
+            headers_["Content-Type"] = "application/json"
+        return headers_
+
     @staticmethod
     def _get_body(
         data: dict[str, Any] | BaseModel | list[dict[str, Any]] | list[BaseModel] | None = None,
@@ -50,10 +67,11 @@ async def post(
     ) -> Response:
         if query:
             url = self._prepare_url(url, query)
+        body = self._get_body(data)
         response = await self.client.post(
             url,
-            content=self._get_body(data),
-            headers=self._get_updated_headers(headers),
+            content=body,
+            headers=self._get_json_headers(headers, body, files),
             files=files,
         )
         return response
@@ -67,10 +85,11 @@ async def put(
     ) -> Response:
         if query:
             url = self._prepare_url(url, query)
+        body = self._get_body(data)
         response = await self.client.put(
             url,
-            content=self._get_body(data),
-            headers=self._get_updated_headers(headers),
+            content=body,
+            headers=self._get_json_headers(headers, body),
         )
         return response
 
@@ -94,11 +113,12 @@ async def delete(
     ) -> Response:
         if query:
             url = self._prepare_url(url, query)
+        body = self._get_body(data)
         response = await self.client.request(
             "DELETE",
             url,
-            content=self._get_body(data),
-            headers=self._get_updated_headers(headers),
+            content=body,
+            headers=self._get_json_headers(headers, body),
         )
         return response
 

src/infrastructure/app.py

@@ -47,7 +47,7 @@
     sqlalchemy_database_error_handler,
     starlette_http_exception_handler,
 )
-from infrastructure.lifespan import shutdown, startup
+from infrastructure.lifespan import lifespan
 from infrastructure.logger import logger
 
 # Declare your routers here
@@ -108,11 +108,9 @@ def create_app():
         description=f"Commit id: <b>{settings.commit_id}</b><br>Version: <b>{settings.version}</b>",
         default_response_class=ORJSONResponse,
         debug=settings.debug,
+        lifespan=lifespan,
     )
 
-    app.add_event_handler("startup", startup(app))
-    app.add_event_handler("shutdown", shutdown(app))
-
     if settings.sentry.dsn:
         sentry_sdk.init(dsn=settings.sentry.dsn, traces_sample_rate=1.0)
 

src/infrastructure/lifespan.py

@@ -1,3 +1,6 @@
+from contextlib import asynccontextmanager
+from typing import AsyncIterator
+
 from fastapi import FastAPI
 
 from broker import broker
@@ -16,15 +19,8 @@ async def shutdown_taskiq() -> None:
         await broker.shutdown()
 
 
-def startup(app: FastAPI):
-    async def _startup():
-        await startup_taskiq()
-
-    return _startup
-
-
-def shutdown(app: FastAPI):
-    async def _shutdown():
-        await shutdown_taskiq()
-
-    return _shutdown
+@asynccontextmanager
+async def lifespan(app: FastAPI) -> AsyncIterator[None]:
+    await startup_taskiq()
+    yield
+    await shutdown_taskiq()