📌 chore: Security updates

Django CVE-2025-48432
requests CVE-2024-47081
h11 CVE-2025-43859

Author: CharString

backend/requirements/base.txt

@@ -37,7 +37,7 @@ cryptography==44.0.2
     #   mozilla-django-oidc
     #   pyopenssl
     #   webauthn
-django==5.2.1
+django==5.2.3
     # via
     #   -r requirements/base.in
     #   django-admin-index
@@ -191,7 +191,7 @@ referencing==0.36.2
     # via
     #   jsonschema
     #   jsonschema-specifications
-requests==2.32.3
+requests==2.32.4
     # via
     #   ape-pie
     #   django-rosetta
@@ -203,8 +203,6 @@ rpds-py==0.24.0
     #   referencing
 ruamel-yaml==0.18.10
     # via django-setup-configuration
-ruamel-yaml-clib==0.2.12
-    # via ruamel-yaml
 sentry-sdk==2.25.1
     # via -r requirements/base.in
 six==1.17.0
@@ -219,9 +217,7 @@ typing-extensions==4.13.1
     #   mozilla-django-oidc-db
     #   pydantic
     #   pydantic-core
-    #   pyopenssl
     #   qrcode
-    #   referencing
     #   typing-inspection
     #   zgw-consumers
 typing-inspection==0.4.0

backend/requirements/ci.txt

@@ -75,7 +75,7 @@ cryptography==44.0.2
     #   webauthn
 cssselect==1.3.0
     # via pyquery
-django==5.2.1
+django==5.2.3
     # via
     #   -c requirements/base.txt
     #   -r requirements/base.txt
@@ -270,6 +270,8 @@ jsonschema-specifications==2024.10.1
     #   -c requirements/base.txt
     #   -r requirements/base.txt
     #   jsonschema
+legacy-cgi==2.6.3
+    # via webob
 lxml==5.3.1
     # via pyquery
 markupsafe==3.0.2
@@ -295,6 +297,8 @@ msgspec==0.19.0
     # via
     #   -c requirements/base.txt
     #   -r requirements/base.txt
+multidict==6.4.4
+    # via yarl
 orderedmultidict==1.0.1
     # via
     #   -c requirements/base.txt
@@ -320,6 +324,8 @@ polib==1.2.0
     #   -c requirements/base.txt
     #   -r requirements/base.txt
     #   django-rosetta
+propcache==0.3.2
+    # via yarl
 psycopg2==2.9.10
     # via
     #   -c requirements/base.txt
@@ -409,7 +415,7 @@ referencing==0.36.2
     #   -r requirements/base.txt
     #   jsonschema
     #   jsonschema-specifications
-requests==2.32.3
+requests==2.32.4
     # via
     #   -c requirements/base.txt
     #   -r requirements/base.txt
@@ -434,11 +440,6 @@ ruamel-yaml==0.18.10
     #   -c requirements/base.txt
     #   -r requirements/base.txt
     #   django-setup-configuration
-ruamel-yaml-clib==0.2.12
-    # via
-    #   -c requirements/base.txt
-    #   -r requirements/base.txt
-    #   ruamel-yaml
 sentry-sdk==2.25.1
     # via
     #   -c requirements/base.txt
@@ -490,9 +491,7 @@ typing-extensions==4.13.1
     #   mozilla-django-oidc-db
     #   pydantic
     #   pydantic-core
-    #   pyopenssl
     #   qrcode
-    #   referencing
     #   typing-inspection
     #   zgw-consumers
 typing-inspection==0.4.0

backend/requirements/dev.in

@@ -22,3 +22,8 @@ django-cors-headers
 # openapi type generator
 httpx[cli]
 datamodel-code-generator[http]
+
+# CVE pins
+# These are sub-dependencies and can be completely removed when they have no
+# "via" anymore in the .txt
+h11>=0.16.0  # CVE-2025-43859

backend/requirements/dev.txt

@@ -110,7 +110,7 @@ cssselect==1.3.0
     #   pyquery
 datamodel-code-generator==0.30.1
     # via -r requirements/dev.in
-django==5.2.1
+django==5.2.3
     # via
     #   -c requirements/ci.txt
     #   -r requirements/ci.txt
@@ -297,9 +297,11 @@ glom==24.11.0
     #   -c requirements/ci.txt
     #   -r requirements/ci.txt
     #   mozilla-django-oidc-db
-h11==0.14.0
-    # via httpcore
-httpcore==1.0.7
+h11==0.16.0
+    # via
+    #   -r requirements/dev.in
+    #   httpcore
+httpcore==1.0.9
     # via httpx
 httpx==0.28.1
     # via
@@ -354,6 +356,11 @@ jsonschema-specifications==2024.10.1
     #   -c requirements/ci.txt
     #   -r requirements/ci.txt
     #   jsonschema
+legacy-cgi==2.6.3
+    # via
+    #   -c requirements/ci.txt
+    #   -r requirements/ci.txt
+    #   webob
 lxml==5.3.1
     # via
     #   -c requirements/ci.txt
@@ -436,6 +443,11 @@ polib==1.2.0
     #   django-rosetta
 prompt-toolkit==3.0.50
     # via questionary
+propcache==0.3.2
+    # via
+    #   -c requirements/ci.txt
+    #   -r requirements/ci.txt
+    #   yarl
 psycopg2==2.9.10
     # via
     #   -c requirements/ci.txt
@@ -540,7 +552,7 @@ referencing==0.36.2
     #   -r requirements/ci.txt
     #   jsonschema
     #   jsonschema-specifications
-requests==2.32.3
+requests==2.32.4
     # via
     #   -c requirements/ci.txt
     #   -r requirements/ci.txt
@@ -577,11 +589,6 @@ ruamel-yaml==0.18.10
     #   -c requirements/ci.txt
     #   -r requirements/ci.txt
     #   django-setup-configuration
-ruamel-yaml-clib==0.2.12
-    # via
-    #   -c requirements/ci.txt
-    #   -r requirements/ci.txt
-    #   ruamel-yaml
 ruff==0.11.12
     # via -r requirements/dev.in
 sentry-sdk==2.25.1
@@ -674,14 +681,11 @@ typing-extensions==4.13.1
     # via
     #   -c requirements/ci.txt
     #   -r requirements/ci.txt
-    #   anyio
     #   beautifulsoup4
     #   mozilla-django-oidc-db
     #   pydantic
     #   pydantic-core
-    #   pyopenssl
     #   qrcode
-    #   referencing
     #   rich-click
     #   typeguard
     #   typing-inspection