[Snyk] Fix for 2 vulnerabilities

[simensma-fresh]

Snyk has created this PR to fix 2 vulnerabilities in the pip dependencies of this project.

Snyk changed the following file(s):

• services/core-api/requirements.txt

⚠️ Warning

python-docx 1.1.0 requires lxml, which is not installed.
marshmallow-sqlalchemy 0.23.1 requires marshmallow, which is not installed.
Flask-Caching 2.1.0 has requirement cachelib<0.10.0,>=0.9.0, but you have cachelib 0.10.2.
celery 5.3.0 requires kombu, which is not installed.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.
• Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the affected dependencies could be upgraded.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 XML External Entity (XXE) Injection

[Copilot]

Pull request overview

This PR updates services/core-api Python dependencies to address two Snyk-reported vulnerabilities by upgrading an existing dependency and adding an explicit dependency version constraint.

Changes:

• Upgraded python-dotenv from 0.10.3 to 1.2.2.
• Added an explicit lxml dependency constraint (>=6.1.0) to mitigate a vulnerability.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

lxml is described as "pinned" but the specifier is >=6.1.0, which allows future major/minor upgrades and makes installs non-reproducible (especially since nearly all other dependencies in this file use exact == pins). Consider pinning to an exact version (or adding an upper bound) and adjust the comment to match the chosen constraint style.

Suggested change

	lxml>=6.1.0 # not directly required, pinned by Snyk to avoid a vulnerability
	lxml==6.1.0 # not directly required; pinned to avoid a vulnerability

[sonarqubecloud]

Quality Gate passed for 'bcgov-sonarcloud_mds_core-api'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud