[Vishalan]

Summary

Bumps six Python dependencies that still sit below their advisory's patched version on main.

Ticket	Package	Pin	Patched	Advisory
CTO-5463	gitpython	3.1.59 -> 3.1.60	3.1.60	GHSA-g5vv-9gxw-82hx (ReDoS)
CTO-5464	PyJWT	2.13.0 -> 2.14.0	2.14.0	GHSA-ffc3-869f-jxw9
CTO-5465	urllib3	2.7.0 -> 2.8.0	2.8.0	GHSA-8988-9cw3-xx77
CTO-5563	msgpack	1.2.1 -> 1.2.3	1.2.3	GHSA-j586-36cw-2gc2
CTO-5564	oauthlib	3.3.1 -> 4.0.1	4.0.1	GHSA-3jp2-3mrg-2vxc (major bump)
CTO-5611	pyasn1	0.6.4 -> 0.6.5	0.6.5	GHSA-fm9c-5rcf-2q5p

Already fixed on main, no change here: CTO-3602 (Django 4.2.30), CTO-5546 (certifi 2026.10.19), CTO-5566 (commit 84ebe5a).

Testing

• Local venv (Python 3.11, sqlite, access modules cloned): pytest 140 passed, 8 skipped, same as main.
• pylama Access/accessrequest_helper.py scripts bootprocess: clean.
• semgrep --config p/cwe-top-25 --config p/r2c-security-audit: clean.
• Docker make test not run: Colima VM disk lock on this machine.

Review notes

• oauthlib 4.0.1 is a major bump. Unit tests pass, but the device-code flow has not been exercised live. Worth a manual check on staging before release.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Central YAML (base), Organization UI (inherited), Workspace UI (inherited); Enforced overrides: Organization
• Review profile: ASSERTIVE
• Plan: Enterprise
• Run ID: 0684256d-ba9b-4567-a0b8-87585cf805de

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts