deps: resolve high-severity Dependabot vulnerabilities

.github/workflows/publish.yml

@@ -17,7 +17,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: '3.11'
+          python-version: '3.12'
 
       - name: Install build tools
         run: pip install build twine

.github/workflows/python.yml

@@ -25,7 +25,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: "3.11"
+          python-version: "3.12"
 
       - name: Install dependencies
         run: pip install -r requirements-dev.txt
@@ -42,7 +42,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: "3.11"
+          python-version: "3.12"
 
       - name: Install dependencies
         run: pip install -r requirements-dev.txt

Makefile

@@ -114,8 +114,8 @@ format-python:
 # Update requirements files with exact pins from pyproject.toml
 update-requirements:
 	@echo "Updating requirements files from pyproject.toml..."
-	pip-compile --resolver=backtracking pyproject.toml --output-file requirements.txt
-	pip-compile --resolver=backtracking --extra dev pyproject.toml --output-file requirements-dev.txt
+	pip-compile --resolver=backtracking --upgrade pyproject.toml --output-file requirements.txt
+	pip-compile --resolver=backtracking --upgrade --extra dev pyproject.toml --output-file requirements-dev.txt
 	@echo "Requirements updated! Review changes before committing."
 
 # Help target

demo-ui/package.json

@@ -17,7 +17,7 @@
     "@tanstack/react-query": "^5.17.0",
     "@tanstack/react-query-devtools": "^5.17.0",
     "@tanstack/react-table": "^8.21.3",
-    "axios": "^1.6.5",
+    "axios": "^1.13.5",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "diff": "^8.0.2",
@@ -33,6 +33,11 @@
     "tailwindcss-animate": "^1.0.7",
     "zod": "^3.25.76"
   },
+  "overrides": {
+    "@remix-run/router": ">=1.23.2",
+    "rollup": ">=4.59.0",
+    "minimatch": ">=9.0.7"
+  },
   "scripts": {
     "dev": "vite",
     "tsc": "tsc -p tsconfig.app.json --noEmit --pretty",

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "julee"
-version = "0.1.10"
+version = "0.1.11"
 description = "Julee - Clean architecture for accountable and transparent digital supply chains"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -27,7 +27,7 @@ dependencies = [
     # Core Web Framework
     "fastapi>=0.100.0",
     "uvicorn>=0.20.0",
-    "python-multipart",
+    "python-multipart>=0.0.22",
     "fastapi-pagination>=0.12.0",
     # Data Validation and Serialization
     "pydantic>=2.0.0",

requirements-dev.txt

@@ -1,5 +1,5 @@
 #
-# This file is autogenerated by pip-compile with Python 3.11
+# This file is autogenerated by pip-compile with Python 3.12
 # by the following command:
 #
 #    pip-compile --extra=dev --output-file=requirements-dev.txt pyproject.toml
@@ -10,9 +10,9 @@ annotated-doc==0.0.4
     # via fastapi
 annotated-types==0.7.0
     # via pydantic
-anthropic==0.75.0
+anthropic==0.84.0
     # via julee (pyproject.toml)
-anyio==4.12.0
+anyio==4.12.1
     # via
     #   anthropic
     #   httpx
@@ -27,15 +27,15 @@ attrs==25.4.0
     # via
     #   jsonschema
     #   referencing
-babel==2.17.0
+babel==2.18.0
     # via sphinx
-bandit==1.9.2
+bandit==1.9.4
     # via julee (pyproject.toml)
-black==25.12.0
+black==26.1.0
     # via julee (pyproject.toml)
-build==1.3.0
+build==1.4.0
     # via pip-tools
-certifi==2025.11.12
+certifi==2026.2.25
     # via
     #   httpcore
     #   httpx
@@ -53,30 +53,32 @@ click==8.3.1
     #   julee (pyproject.toml)
     #   pip-tools
     #   uvicorn
-coverage[toml]==7.13.0
+coverage[toml]==7.13.4
     # via pytest-cov
 distlib==0.4.0
     # via virtualenv
 distro==1.9.0
     # via anthropic
 docstring-parser==0.17.0
     # via anthropic
-docutils==0.22.3
+docutils==0.22.4
     # via sphinx
 execnet==2.1.2
     # via pytest-xdist
 factory-boy==3.3.3
     # via julee (pyproject.toml)
-faker==38.2.0
+faker==40.5.1
     # via factory-boy
-fastapi==0.124.2
+fastapi==0.135.1
     # via
     #   fastapi-pagination
     #   julee (pyproject.toml)
-fastapi-pagination==0.15.2
+fastapi-pagination==0.15.10
     # via julee (pyproject.toml)
-filelock==3.20.0
-    # via virtualenv
+filelock==3.25.0
+    # via
+    #   python-discovery
+    #   virtualenv
 h11==0.16.0
     # via
     #   httpcore
@@ -85,32 +87,32 @@ httpcore==1.0.9
     # via httpx
 httpx==0.28.1
     # via anthropic
-hypothesis==6.148.7
+hypothesis==6.151.9
     # via julee (pyproject.toml)
-identify==2.6.15
+identify==2.6.17
     # via pre-commit
 idna==3.11
     # via
     #   anyio
     #   httpx
     #   requests
-imagesize==1.4.1
+imagesize==2.0.0
     # via sphinx
 iniconfig==2.3.0
     # via pytest
 jinja2==3.1.6
     # via
     #   julee (pyproject.toml)
     #   sphinx
-jiter==0.12.0
+jiter==0.13.0
     # via anthropic
 jsonpointer==3.0.0
     # via julee (pyproject.toml)
-jsonschema==4.25.1
+jsonschema==4.26.0
     # via julee (pyproject.toml)
 jsonschema-specifications==2025.9.1
     # via jsonschema
-librt==0.7.3
+librt==0.8.1
     # via mypy
 markdown-it-py==4.0.0
     # via rich
@@ -122,41 +124,43 @@ minio==7.2.20
     # via julee (pyproject.toml)
 multihash==0.1.1
     # via julee (pyproject.toml)
-mypy==1.19.0
+mypy==1.19.1
     # via julee (pyproject.toml)
 mypy-extensions==1.1.0
     # via
     #   black
     #   mypy
-nexus-rpc==1.2.0
+nexus-rpc==1.3.0
     # via temporalio
-nodeenv==1.9.1
+nodeenv==1.10.0
     # via pre-commit
-packaging==25.0
+packaging==26.0
     # via
     #   black
     #   build
     #   pytest
     #   sphinx
-pathspec==0.12.1
+    #   wheel
+pathspec==1.0.4
     # via
     #   black
     #   mypy
-pip-tools==7.5.2
+pip-tools==7.5.3
     # via julee (pyproject.toml)
-platformdirs==4.5.1
+platformdirs==4.9.2
     # via
     #   black
+    #   python-discovery
     #   virtualenv
 pluggy==1.6.0
     # via
     #   pytest
     #   pytest-cov
-pre-commit==4.5.0
+pre-commit==4.5.1
     # via julee (pyproject.toml)
-protobuf==6.33.2
+protobuf==6.33.5
     # via temporalio
-pycparser==2.23
+pycparser==3.0
     # via cffi
 pycryptodome==3.23.0
     # via minio
@@ -190,11 +194,13 @@ pytest-cov==7.0.0
     # via julee (pyproject.toml)
 pytest-xdist==3.8.0
     # via julee (pyproject.toml)
+python-discovery==1.1.0
+    # via virtualenv
 python-magic==0.4.27
     # via julee (pyproject.toml)
-python-multipart==0.0.20
+python-multipart==0.0.22
     # via julee (pyproject.toml)
-pytokens==0.3.0
+pytokens==0.4.1
     # via black
 pyyaml==6.0.3
     # via
@@ -208,15 +214,15 @@ referencing==0.37.0
     #   types-jsonschema
 requests==2.32.5
     # via sphinx
-rich==14.2.0
+rich==14.3.3
     # via bandit
 roman-numerals==4.1.0
     # via sphinx
 rpds-py==0.30.0
     # via
     #   jsonschema
     #   referencing
-ruff==0.14.8
+ruff==0.15.4
     # via julee (pyproject.toml)
 six==1.17.0
     # via julee (pyproject.toml)
@@ -226,7 +232,7 @@ snowballstemmer==3.0.1
     # via sphinx
 sortedcontainers==2.4.0
     # via hypothesis
-sphinx==9.0.4
+sphinx==9.1.0
     # via julee (pyproject.toml)
 sphinxcontrib-applehelp==2.0.0
     # via sphinx
@@ -240,17 +246,17 @@ sphinxcontrib-qthelp==2.0.0
     # via sphinx
 sphinxcontrib-serializinghtml==2.0.0
     # via sphinx
-starlette==0.50.0
+starlette==0.52.1
     # via fastapi
-stevedore==5.6.0
+stevedore==5.7.0
     # via bandit
-temporalio[pydantic]==1.20.0
+temporalio[pydantic]==1.23.0
     # via julee (pyproject.toml)
-types-jsonschema==4.25.1.20251009
+types-jsonschema==4.26.0.20260202
     # via julee (pyproject.toml)
-types-protobuf==6.32.1.20251210
+types-protobuf==6.32.1.20260221
     # via temporalio
-types-python-dateutil==2.9.0.20251115
+types-python-dateutil==2.9.0.20260302
     # via julee (pyproject.toml)
 types-pyyaml==6.0.12.20250915
     # via julee (pyproject.toml)
@@ -271,18 +277,18 @@ typing-extensions==4.15.0
     #   temporalio
     #   typing-inspection
 typing-inspection==0.4.2
-    # via pydantic
-tzdata==2025.2
-    # via faker
-urllib3==2.6.1
+    # via
+    #   fastapi
+    #   pydantic
+urllib3==2.6.3
     # via
     #   minio
     #   requests
-uvicorn==0.38.0
+uvicorn==0.41.0
     # via julee (pyproject.toml)
-virtualenv==20.35.4
+virtualenv==21.1.0
     # via pre-commit
-wheel==0.45.1
+wheel==0.46.3
     # via pip-tools
 
 # The following packages are considered to be unsafe in a requirements file: