Python: Bump authlib from 1.6.11 to 1.6.12 in /python

[dependabot]

Bumps authlib from 1.6.11 to 1.6.12.

Release notes

Sourced from authlib's releases.

v1.6.12

• • Fix redirecting to unvalidated redirect_uri on InvalidScopeError in OpenIDImplicitGrant and OpenIDHybridGrant. Full Changelog: authlib/authlib@v1.6.11...v1.6.12

Changelog

Sourced from authlib's changelog.

Version 1.6.12

Released on may 4, 2026

• Fix redirecting to unvalidated redirect_uri on InvalidScopeError in OpenIDImplicitGrant and OpenIDHybridGrant.

Commits

• e46e515 chore: bump to 1.6.12
• 9babc13 fix: redirecting to unvalidated redirect_uri on InvalidScopeError in OIDC grants
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[github-actions]

Automated Code Review

Reviewers: 4 | Confidence: 61%

✓ Correctness

This is a straightforward Dependabot security patch bumping authlib from 1.6.11 to 1.6.12 in the uv.lock file. The authlib update fixes a security issue (redirecting to unvalidated redirect_uri on InvalidScopeError). The lock file also reflects updated version ranges for boto3, google-genai, mistralai, and pydantic which are consistent with the pyproject.toml declarations. No correctness issues found.

✓ Security Reliability

This is a straightforward Dependabot security update bumping authlib from 1.6.11 to 1.6.12 in the uv.lock file. The new version fixes a security vulnerability involving unvalidated redirect_uri on InvalidScopeError in OpenIDImplicitGrant and OpenIDHybridGrant. The lock file correctly includes updated hashes from PyPI. The other changes in the requires-dist section (boto3, google-genai, mistralai, pydantic upper bounds) reflect what is already specified in pyproject.toml and are just the result of lock file regeneration. No security or reliability concerns with this change.

✓ Test Coverage

This PR is a Dependabot security bump of authlib from 1.6.11 to 1.6.12 (fixing an unvalidated redirect_uri issue). The change is confined entirely to python/uv.lock with no source code modifications. authlib is not directly imported anywhere in the Python source (it's a transitive dependency), so no new tests are warranted. The existing test suite serves as the compatibility check for this lock file update. The additional version range widenings (boto3, google-genai, mistralai, pydantic) are also lock-file-only constraint updates requiring no new test coverage.

✗ Design Approach

This lockfile bump does update the repo’s uv sync environment, but it does not address the published dependency surface that users install from. authlib is only present transitively through weaviate-client, and the package metadata/docs still expose installs via pip install semantic-kernel[...], so consumers of the weaviate extra can still resolve an older authlib outside this lockfile.

Flagged Issues

• The lockfile-only bump does not protect package consumers. authlib is a transitive dependency of weaviate-client and is not declared in pyproject.toml. Since users install via pip install semantic-kernel[weaviate] (per python/README.md:20-23), they can still resolve a vulnerable authlib version. If the goal is to fix the shipped dependency surface, a lower-bound constraint on authlib>=1.6.12 should be added to pyproject.toml, not just uv.lock.

---

Automated review by dependabot[bot]'s agents

[github-actions]

This only updates the repo-local lockfile. authlib is not part of the published project metadata — it enters the dependency graph transitively via weaviate-client>=4.17.0,<5.0 (python/pyproject.toml:155-157). Users installing with pip install semantic-kernel[weaviate] can still resolve an older authlib. If this PR is meant to remediate the vulnerability for consumers, add authlib>=1.6.12 as an explicit constraint in pyproject.toml.