chore(deps): security upgrade — patch 36 transitive CVEs

pyproject.toml

@@ -15,6 +15,8 @@ dependencies = [
     "humanize>=3.5.0",
     "tabulate>=0.8.9",
     "packaging>=24.1",
+    # Transitive security pins
+    "urllib3>=2.7.0",
 ]
 
 [project.scripts]
@@ -23,13 +25,20 @@ gitops = "gitops.main:program.run"
 
 [project.optional-dependencies]
 server = [
-    "httpx>=0.23.0,<0.24.0",
+    "httpx>=0.27.0",
     "uvicorn>=0.34.0",
-    "fastapi==0.109.2",
+    "fastapi>=0.133.0",
     "kubernetes_asyncio>=25.1.2",
     "sentry-sdk>=1.3.0",
     "uptick-observability[fastapi]>=0.2.2",
     "slack-sdk>=3.33.5",
+    # Transitive security pins
+    "h11>=0.16.0",
+    "aiohttp>=3.14.0",
+    "starlette>=1.3.1",
+    "protobuf>=5.29.6",
+    "requests>=2.33.0",
+    "idna>=3.15",
 ]
 
 [build-system]

tests/test_gitops_server.py

@@ -22,12 +22,14 @@ def test_get_on_index_returns_200():
 
 @patch("gitops_server.main.settings.GITHUB_WEBHOOK_KEY", "test_key")
 def test_webhook_returns_200_if_hmac_is_correct():
-    sha_encoding = hmac.new(b"test_key", json.dumps(payload).encode(), hashlib.sha1).hexdigest()
+    body = json.dumps(payload).encode()
+    sha_encoding = hmac.new(b"test_key", body, hashlib.sha1).hexdigest()
     headers["X-Hub-Signature"] = f"sha1={sha_encoding}"
+    headers["Content-Type"] = "application/json"
 
     with patch.object(gitops_server.workers.DeployQueueWorker, "get_worker") as get_worker_mock:
         get_worker_mock.return_value = AsyncMock()
-        response = client.post("/webhook", headers=headers, json=payload)
+        response = client.post("/webhook", headers=headers, content=body)
 
         assert response.status_code == 200
         get_worker_mock.assert_called()