[vthorsteinsson]

Clears all eight open Dependabot alerts on master.

Alert	Package	Change	Exposure
#17 high, #18 medium	urllib3	2.7.0 → 2.8.0	Real. A hostile server can make a download buffer an unbounded chunk-size line (#17) or loop forever on chunked deflate (#18). fetcher.py and scrapers/default.py fetch external news sites with requests.
#16 high	urllib3	2.7.0 → 2.8.0	Only behind an HTTPS proxy; none is configured in code.
#19 medium	Werkzeug	3.1.8 → 3.1.9	safe_join() with Windows device names; production is Linux.
#14, #15 medium	oauthlib	3.3.1 → 4.0.0	Server-side OAuth endpoints. oauthlib only comes in via python-youtube, which queries/play.py uses with an API key.
#5, #8 low	Flask	2.3.3 → 3.1.3	Missing Vary: Cookie with Flask sessions, which we do not use.

Flask 3.0 removed flask._request_ctx_stack. routes/__init__.py imported it but never used it, so the import is deleted. Nothing else we import from Flask was removed in 3.x, and flask-caching 2.4.1 and flask-cors 6.0.5 support Flask 3. The Flask==2.3.3 pin dated from 2023 (then the latest release), not from a known incompatibility.

uv.lock changes only these four packages.

Testing

• scripts/test_local.sh: 88 passed, 7 skipped, no warnings from the upgraded packages.
• Booted under gunicorn (main:app): /, /about and /postag.api return 200.
• /static/fonts/glyphicons-regular.woff serves with max-age=86400 via send_from_directory; an encoded ../ path returns 404.

🤖 Generated with Claude Code