fix(deps): update website-backend

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
Flask-Caching (changelog)	==2.3.1 → ==2.4.0
Flask-Compress	==1.17 → ==1.24
cvss (changelog)	==3.4 → ==3.6
google-auth	==2.38.0 → ==2.49.2
google-cloud-logging (source)	==3.11.4 → ==3.15.0
google-cloud-ndb (source)	==2.3.2 → ==2.4.2
markdown2	==2.5.3 → ==2.5.5
packageurl-python	==0.16.0 → ==0.17.6
pylint (changelog)	3.3.5 → 3.3.9
whitenoise (changelog)	==6.9.0 → ==6.12.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

pallets-eco/flask-caching (Flask-Caching)

v2.4.0

Compare Source

2026-04-17

• Modernize project setup
• Update intersphinx_mapping for Sphinx 8 compatibility. :pr:599, :issue:598
• Pass CACHE_OPTIONS as kwargs to redis_from_url. :pr:591
• Pass sentinel_kwargs to redis client via CACHE_OPTIONS :pr:626
• Fix response_hit_indication return True always. :pr:579, :pr:596, :issue:595, :issue:570

colour-science/flask-compress (Flask-Compress)

v1.24

Compare Source

• add mypy annotations and mark it as checkable, #​76 by @​orborde
• enable trusted publishing, allowing GitHub Actions to publish releases to PyPI without long lived credentials, #​78 by @​alexprengere

v1.23

Compare Source

• add gzip to supported algorithms for streaming responses, but not in the COMPRESS_ALGORITHM_STREAMING default values, so users have to explicitly enable it
• add Windows and MacOS to the list of platforms tested on GitHub Actions

v1.22

Compare Source

• fix possible RuntimeError when applying compression to a streaming endpoint
• no longer apply make_conditional to streaming responses, as it had the effect of buffering the entire response, which defeats the purpose of streaming responses, unless the request.endpoint is in a new COMPRESS_STREAMING_ENDPOINT_CONDITIONAL config option, which defaults to ["static"]

As serving static content with Flask is using streaming responses, we wanted to preserve the correct handling of conditional requests (i.e. 304 Not Modified responses) for static content, while avoiding buffering the entire response when compressing streaming responses for other endpoints

v1.21

Compare Source

• compressing streaming responses is now supported:
  • the previous behavior was:
    • if COMPRESS_STREAMS was True (the default), streaming responses were compressed in 1 sitting using response.get_data(), meaning streaming responses were compressed but not streamed
    • if COMPRESS_STREAMS was False, streaming responses were not compressed at all
  • the new behavior is:
    • if COMPRESS_STREAMS is True, streaming responses are compressed chunk-by-chunk using response.iter_encoded(), which means that streaming responses are compressed and streamed
    • if COMPRESS_STREAMS is False, streaming responses are not compressed at all, as before.
  • we have a new COMPRESS_ALGORITHM_STREAMING config option to specify the compression algorithm to use for streaming responses, which defaults to ["zstd", "br", "deflate"], as "gzip" is not suitable for streaming compression.
  • ⚠️ serving static content with Flask is actually using streaming responses, so if you enable streaming compression, static content will be compressed chunk-by-chunk as well, which may not be what you want.

v1.20

Compare Source

• the new COMPRESS_EVALUATE_CONDITIONAL_REQUEST config option is now True by default

v1.19

Compare Source

• Use backports.zstd instead of pyzstd, #​63 by @​alexprengere
• Add new behaviours to improve Etag compatibility, #​67, by @​jlopex
  • weak etags are no longer modified by flask-compress
  • add new COMPRESS_EVALUATE_CONDITIONAL_REQUEST config option to call response.make_conditional(request) after compression, this ensures that 304 Not Modified responses are correctly generated when the client sends conditional requests with If-None-Match (defaults to False)

v1.18

Compare Source

• Support, and test against, Python 3.14, see #​61 by @​kurtmckee
• Migrate from zstandard to pyzstd, which is now included in the Python 3.14 standard library, also part of #​61
• Restore flask_compress.DictCache() that is needed to configure Flask-Compress with caching, without relying on Flask-Caching

RedHatProductSecurity/cvss (cvss)

v3.6

Compare Source

Fix incorrect release in PyPI

googleapis/google-auth-library-python (google-auth)

v2.48.0

Compare Source

Features

• add cryptography as required dependency (#​1929) (52558ae2881b1e6555f6f5c0d76365c15807ead9)
• Support the mTLS IAM domain for Certificate based Access (#​1938) (8dcf91a1b05c85fbbd0bcee78d66e498099102ab)
• add configurable GCE Metadata Server retries (#​1488) (454b441b478ec62bbf1a6ad5bceb6c7cbbfd0c37)
• honor NO_GCE_CHECK environment variable (#​1610) (383c9827536d9376e8248370ce4c2b83e468d027)

Bug Fixes

• resolve circular imports (#​1942) (25c1b064545702cbef087cfcd15fbbb6ef1af74f)
• removes content-header from AWS IMDS get request (#​1934) (97bfea9e02ede953fc8ee154e0deed3a3cfc6dcc)
• detect correct auth when ADC env var is set but empty (#​1374) (bfc07e1050bd0aa86fa3b08cdf70c9b68b5fe6a2)
• replace deprecated utcfromtimestamp (#​1799) (e431f20cf73ccac71926a23ec454468cea92e053)
• Use user_verification=preferred for ReAuth WebAuthn challenge (#​1798) (3f88a24089c4ee6822d510de0db210b54260d873)

v2.47.0

Compare Source

Features

• drop cachetools dependency in favor of simple local implementation (#​1590) (5c07e1c4f52bc77a1b16fa3b7b3c5269c242f6f4)

Bug Fixes

• Python 3.8 support (#​1918) (60dc20014a35ec4ba71e8065b9a33ecbdbeca97a)

v2.46.0

Compare Source

Documentation

• update urllib3 docstrings for v2 compatibility (#​1903) (3f1aeea2d1014ea1d244a4c3470e52d74d55404b)

Features

• Recognize workload certificate config in has_default_client_cert_source for mTLS for Agentic Identities (#​1907) (0b9107d573123e358c347ffa067637f992af61b4)

Bug Fixes

• add types to default and verify_token and Request init based on comments in the source code. (#​1588) (59a5f588f7793b59d923a4185c8c07738da618f7)
• fix the document of secure_authorized_session (#​1536) (5d0014707fc359782df5ccfcaa75fd372fe9dce3)
• remove setup.cfg configuration for creating universal wheels (#​1693) (c767531ce05a89002d109f595187aff1fcaacfb7)
• use .read() instead of .content.read() in aiohttp transport (#​1899) (12f4470f808809e8abf1141f98d88ab720c3899b)
• raise RefreshError for missing token in impersonated credentials (#​1897) (94d04e090fdfc61926dd32bc1d65f8820b9cede5)
• Fix test coverage for mtls_helper (#​1886) (02e71631fe275d93825c2e957e830773e75133f7)

v2.45.0

Compare Source

Features

• Adding Agent Identity bound token support and handling certificate mismatches with retries (#​1890) (b32c934e6b0d09b94c467cd432a0a635e8b05f5c)

v2.44.0

Compare Source

Features

• support Python 3.14 (#​1822) (0f7097e78f247665b6ef0287d482033f7be2ed6d)
• add ecdsa p-384 support (#​1872) (39c381a5f6881b590025f36d333d12eff8dc60fc)
• MDS connections use mTLS (#​1856) (0387bb95713653d47e846cad3a010eb55ef2db4c)
• Implement token revocation in STS client and add revoke() metho… (#​1849) (d5638986ca03ee95bfffa9ad821124ed7e903e63)
• Add shlex to correctly parse executable commands with spaces (#​1855) (cf6fc3cced78bc1362a7fe596c32ebc9ce03c26b)

Bug Fixes

• Use public refresh method for source credentials in ImpersonatedCredentials (#​1884) (e0c3296f471747258f6d98d2d9bfde636358ecde)
• Add temporary patch to workload cert logic to accomodate Cloud Run mis-configuration (#​1880) (78de7907b8bdb7b5510e3c6fa8a3f3721e2436d7)
• Delegate workload cert and key default lookup to helper function (#​1877) (b0993c7edaba505d0fb0628af28760c43034c959)

v2.43.0

Compare Source

Features

• Add public wrapper for _mtls_helper.check_use_client_cert which enables mTLS if GOOGLE_API_USE_CLIENT_CERTIFICATE is not set, when the MWID/X.509 cert sources detected (#​1859) Add public wrapper for check_use_client_cert which enables mTLS if
  GOOGLE_API_USE_CLIENT_CERTIFICATE is not set, when the MWID/X.509 cert
  sources detected. Also, fix check_use_client_cert to return boolean
  value.
  Change #​1848 added the check_use_client_cert method that helps know if
  client cert should be used for mTLS connection. However, that was in a
  private class, thus, created a public wrapper of the same function so
  that it can be used by python Client Libraries. Also, updated
  check_use_client_cert to return a boolean value instead of existing
  string value for better readability and future scope.
  --------- (1535eccbff0ad8f3fd6a9775316ac8b77dca66ba)
• Enable mTLS if GOOGLE_API_USE_CLIENT_CERTIFICATE is not set, if the MWID/X.509 cert sources detected (#​1848) The Python SDK will use a hybrid approach for mTLS enablement:

• If the GOOGLE_API_USE_CLIENT_CERTIFICATE environment variable is set
  (either true or false), the SDK will respect that setting. This is
  necessary for test scenarios and users who need to explicitly control
  mTLS behavior.
• If the GOOGLE_API_USE_CLIENT_CERTIFICATE environment variable is not
  set, the SDK will automatically enable mTLS only if it detects Managed
  Workload Identity (MWID) or X.509 Workforce Identity Federation (WIF)
  certificate sources. In other cases where the variable is not set, mTLS
  will remain disabled.
  ** This change also adds the helper method check_use_client_cert and
  it's unit test, which will be used for checking the criteria for setting
  the mTLS to true
  ** This change is only for Auth-Library, other changes will be created
  for Client-Library use-cases.
  --------- (395e405b64b56ddb82ee639958c2e8056ad2e82b)

• onboard google-auth to librarian (#​1838) This PR onboards google-auth library to the Librarian system.
  Wait for
  #​1819. (c503eaa511357d7a76cc1e1f1d3a3be2dabd5bca)

v2.42.1

Compare Source

Bug Fixes

• Catch ValueError for json.loads() (#​1842) (b074cad)

v2.42.0

Compare Source

Features

• Add trust boundary support for external accounts. (#​1809) (36ecb1d)

Bug Fixes

• Read scopes from ADC json for impersoanted cred (#​1820) (62c0fc8)

v2.41.1

Compare Source

Bug Fixes

• Suppress deprecation warning for ADC (#​1815) (751ce3f)

v2.41.0

Compare Source

Features

• Add support for cachetools 6.0 (#​1773) (af18060)
• Add trust boundary support for service accounts and impersonation. (#​1778) (99be2ce)

Bug Fixes

• Deprecating load_credentials_from_dict (58b66ec)
• Deprecating load_credentials_from_file (58b66ec)
• Fix type error in credentials.py for python 3.7 and 3.8 (#​1805) (c30a6a7)

Documentation

• Update user guide to include x509 feature. (#​1802) (2d89ab4)

v2.40.3

Compare Source

Bug Fixes

• Auth fetch token from default endpoint (#​1779) (88891cc)
• Remove unnecessary call to mds service (#​1769) (7c61c7d)
• Retry 504 errors (#​1767) (554f967)

v2.40.2

Compare Source

Bug Fixes

• Remove sync response logs in AuthorizedSession (97ed1c8)
• Update test to consider new error message from cryptography (#​1765) (44e38b6)

v2.40.1

Compare Source

Bug Fixes

• Disable logging response body for async logs (#​1756) (2f0ddfe)

v2.40.0

Compare Source

Features

• Add request response logging to auth (#​1678) (77ad53e)

Bug Fixes

• Correct webauthn JSON parsing to be compliant with standard. (#​1658) (0c5ef36)

v2.39.0

Compare Source

Features

• Adds GA support for X.509 workload identity federation (#​1695) (7495960)

Bug Fixes

• Add impersonated SA via local ADC support for fetch_id_token (#​1740) (f249764)
• Add missing packaging dependency for feature requiring urllib3 (#​1732) (221f4a8)
• Add request timeout for MDS requests (#​1699) (9f7d3fa)
• Explicitly declare support for Python 3.13 (#​1741) (6fd04d5)

googleapis/google-cloud-python (google-cloud-logging)

v3.15.0: google-cloud-logging: v3.15.0

Compare Source

v3.15.0 (2026-03-26)

v3.14.0

Compare Source

v3.13.0

v3.12.1: google-cloud-vision 3.12.1

Bug Fixes

• fix mypy errors (#​15494) (1f4c2862)

v3.12.0: google-cloud-vision 3.12.0

3.12.0 (2026-01-09)

trentm/python-markdown2 (markdown2)

v2.5.5

Compare Source

• [pull #​639] Fix middle-word-em interfering with strongs (#​637)
• [pull #​640] Fix code friendly extra stopping other syntax being processed (#​638)
• [pull #​644] Fix a number of em/strong issues (#​641, #​642, #​643)
• [pull #​659] Fix a number of safemode issues (#​647)
• [pull #​665] Rewrite emphasis and strong processing to be more GFM compliant
• [pull #​672] Fix nested footnote references (#​664)
• [pull #​681] Forbid square brackets in reference link IDs

v2.5.4

Compare Source

• [pull #​617] Add MarkdownFileLinks extra (#​528)
• [pull #​622] Add missing block tags to regex (#​620)
• [pull #​623] Don't escape plus signs in URLs (#​621)
• [pull #​626] Fix XSS when encoding incomplete tags (#​625)
• [pull #​628] Fix TypeError in MiddleWordEm extra when options was None (#​627)
• [pull #​630] Fix nbsp breaking tables (#​629)
• [pull #​634] Fix ReDoS in HTML tokenizer regex (#​633)

package-url/packageurl-python (packageurl-python)

v0.17.6

Compare Source

• Enhance url2purl to support commit hashes parsing (GitHub, GitLab, and Bitbucket)
  #​211

• Adjust validation function
  #​206

• Add validation function
  #​205

v0.17.5

Compare Source

• Remove support for getting download URL for qpkg in purl2url.
  #​203

• Add tests for latest purl-spec
  #​202

v0.17.4

Compare Source

• Add support for getting download URL for debian, apk, qpkg in purl2url.
  #​201

v0.17.3

Compare Source

• Add support for getting download URL for Luarocks, Conda, Alpm in purl2url.
  #​199
• Fix Incorrect download url from build_golang_download_url()
  #​198

v0.17.2

Compare Source

• Add support for getting download URL for Golang, Hex, Pub and Swift in purl2url.
  #​195

v0.17.1

Compare Source

• Define "pkg" as a PackageURL SCHEME class attribute.
  #​184

• Add support for Maven in purl2url.
  #​177

v0.17.0

Compare Source

• Fix qualifiers type annotations.
  #​169

• Fix parsing of names and namespaces with colons.
  #​152

pylint-dev/pylint (pylint)

v3.3.9

Compare Source

What's new in Pylint 3.3.9?

Release date: 2025-10-05

False Positives Fixed

• Fix used-before-assignment for PEP 695 type aliases and parameters.

  Closes #​9815

• No longer flag undeprecated functions in importlib.resources as deprecated.

  Closes #​10593

• Fix false positive inconsistent-return-statements when using quit() or exit() functions.

  Closes #​10508

• Fix false positive undefined-variable (E0602) for for-loop variable shadowing patterns like for item in item: when the variable was previously defined.

  Closes #​10562

Other Bug Fixes

• Fixed crash in 'unnecessary-list-index-lookup' when starting an enumeration using
  minus the length of an iterable inside a dict comprehension when the len call was only
  made in this dict comprehension, and not elsewhere. Also changed the approach,
  to use inference in all cases but the simple ones, so we don't have to fix crashes
  one by one for arbitrarily complex expressions in enumerate.

  Closes #​10510

v3.3.8

Compare Source

What's new in Pylint 3.3.8?

Release date: 2025-08-09

This patch release includes an exceptional fix for a false negative issue. For details, see: #​10482 (comment)

False Positives Fixed

• Fix false positives for possibly-used-before-assignment when variables are exhaustively
  assigned within a match block.

  Closes #​9668

• Fix false positive for missing-raises-doc and missing-yield-doc when the method length is less than docstring-min-length.

  Refs #​10104

• Fix a false positive for unused-variable when multiple except handlers bind the same name under a try block.

  Closes #​10426

False Negatives Fixed

• Fix false-negative for used-before-assignment with from __future__ import annotations in function definitions.

  Refs #​10482

Other Bug Fixes

• Fix a bug in Pyreverse where aggregations and associations were included in diagrams regardless of the selected --filter-mode (such as PUB_ONLY, ALL, etc.).

  Closes #​10373

• Fix double underscores erroneously rendering as bold in pyreverse's Mermaid output.

  Closes #​10402

v3.3.7

Compare Source

What's new in Pylint 3.3.7?

Release date: 2025-05-04

False Positives Fixed

• Comparisons between two calls to type() won't raise an unidiomatic-typecheck warning anymore, consistent with the behavior applied only for == previously.

  Closes #​10161

Other Bug Fixes

• Fixed a crash when importing a class decorator that did not exist with the same name as a class attribute after the class definition.

  Closes #​10105

• Fix a crash caused by malformed format strings when using .format with keyword arguments.

  Closes #​10282

• Using a slice as a class decorator now raises a not-callable message instead of crashing. A lot of checks that dealt with decorators (too many to list) are now shortcut if the decorator can't immediately be inferred to a function or class definition.

  Closes #​10334

Other Changes

• The algorithm used for no-member suggestions is now more efficient and cuts the
  calculation when the distance score is already above the threshold.

  Refs #​10277

v3.3.6

Compare Source

What's new in Pylint 3.3.6?

Release date: 2025-03-20

False Positives Fixed

• Fix a false positive for used-before-assignment when an inner function's return type
  annotation is a class defined at module scope.

  Closes #​9391

evansd/whitenoise (whitenoise)

v6.12.0

Compare Source

v6.11.0

Compare Source

v6.10.0

Compare Source

---

Configuration

📅 Schedule: (in timezone Australia/Sydney)

• Branch creation
  • "before 6am on wednesday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: gcp/website/poetry.lock

Updating dependencies
Resolving dependencies...

Creating virtualenv website-backend-qe55Qd0--py3.14 in /home/ubuntu/.cache/pypoetry/virtualenvs

Because osv (0.0.22) @ file:///tmp/renovate/repos/github/another-rex/osv.dev depends on both packageurl-python (0.16.0) and packageurl-python (0.16.0), packageurl-python is required.
So, because website-backend depends on packageurl-python (0.17.6), version solving failed.