chore(deps): bump the orchestrator-python group in /orchestrator with 6 updates

[dependabot]

Updates the requirements on flask, gunicorn, kubernetes, pyyaml, neo4j and pytest to permit the latest version.
Updates flask to 3.1.3

Release notes

Sourced from flask's releases.

3.1.3

This is the Flask 3.1.3 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.3/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-3

• The session is marked as accessed for operations that only access the keys but not the values, such as in and len. GHSA-68rp-wp8r-4726

Changelog

Sourced from flask's changelog.

Version 3.1.3

Released 2026-02-18

• The session is marked as accessed for operations that only access the keys but not the values, such as in and len. :ghsa:68rp-wp8r-4726

Version 3.1.2

Released 2025-08-19

• stream_with_context does not fail inside async views. :issue:5774
• When using follow_redirects in the test client, the final state of session is correct. :issue:5786
• Relax type hint for passing bytes IO to send_file. :issue:5776

Version 3.1.1

Released 2025-05-13

• Fix signing key selection order when key rotation is enabled via SECRET_KEY_FALLBACKS. :ghsa:4grg-w6v8-c28g
• Fix type hint for cli_runner.invoke. :issue:5645
• flask --help loads the app and plugins first to make sure all commands are shown. :issue:5673
• Mark sans-io base class as being able to handle views that return AsyncIterable. This is not accurate for Flask, but makes typing easier for Quart. :pr:5659

Version 3.1.0

Released 2024-11-13

• Drop support for Python 3.8. :pr:5623
• Update minimum dependency versions to latest feature releases. Werkzeug >= 3.1, ItsDangerous >= 2.2, Blinker >= 1.9. :pr:5624,5633
• Provide a configuration option to control automatic option responses. :pr:5496
• Flask.open_resource/open_instance_resource and Blueprint.open_resource take an encoding parameter to use when opening in text mode. It defaults to utf-8. :issue:5504
• Request.max_content_length can be customized per-request instead of only through the MAX_CONTENT_LENGTH config. Added

... (truncated)

Commits

• 22d9247 release version 3.1.3
• 089cb86 Merge commit from fork
• c17f379 request context tracks session access
• 27be933 start version 3.1.3
• 4e652d3 Abort if the instance folder cannot be created (#5903)
• 3d03098 Abort if the instance folder cannot be created
• 407eb76 document using gevent for async (#5900)
• ac5664d document using gevent for async
• 4f79d5b Increase required flit_core version to 3.11 (#5865)
• fe3b215 Increase required flit_core version to 3.11
• Additional commits viewable in compare view

Updates gunicorn to 26.2.0

Release notes

Sourced from gunicorn's releases.

gunicorn 26.2.0

Cleartext HTTP/2 lands, and an HTTP/2 security fix.

Cleartext HTTP/2 (h2c)

http2_cleartext accepts prior-knowledge, upgrade, both or off (the default). Prior knowledge serves a connection that opens with the HTTP/2 preface; upgrade honours an HTTP/1.1 Upgrade: h2c request. Both work on the gthread, gevent and asgi workers.

This is for deployments where TLS is terminated by a proxy that speaks HTTP/2 upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in forwarded_allow_ips are considered; everyone else is served HTTP/1.x exactly as if the setting were off. Each mechanism is enabled separately, so turning one on does not turn the other on.

Do not expose a cleartext HTTP/2 port to the internet.

Security

HTTP2Request built its headers straight from the stream, so nothing the HTTP/1 path enforces applied over HTTP/2: the underscore and header_map policy, duplicate Host and Content-Type, control characters in values, and the forwarded_allow_ips trust gate. An untrusted client could set SCRIPT_NAME and forge HTTP_* entries in the WSGI environ, and decide wsgi.url_scheme through :scheme. Both request classes now share one policy mixin, and the scheme comes from the transport.

If you serve HTTP/2, this is the reason to upgrade.

Other HTTP/2 fixes

WSGI responses were buffered whole before anything was sent; they stream now. HEAD, 204 and 304 no longer carry a body. Events read while blocked on a flow-control window were discarded, losing requests and body data outright. sendfile() is refused on HTTP/2 responses rather than bypassing framing.

Request bodies dropped on Upgrade requests

On the ASGI worker with the fast parser, any request carrying an Upgrade header reached the application with an empty body, whatever the header's value and with HTTP/2 switched off entirely. Fixed in gunicorn_h1c 0.6.9, which the fast extra now requires.

Full changelog: https://gunicorn.org/news/

Commits

• 36f2a3c gunicorn 26.2.0
• cbba350 test: cover the h2c edge paths that had none
• 9885411 Merge pull request #3703 from cormier/fix-inconsistency-in-control-socket-docs
• 86f0919 Merge pull request #3704 from methane/doc-wsgi-h1c
• 5853551 Merge pull request #3712 from Rotzbua/patch-1
• 7bce87e Merge pull request #3700 from benoitc/fix/sponsor-logo-path
• 972dfb0 Merge pull request #3690 from melbinjp/docs/contributing-settings-path
• 7b3f16b Merge pull request #3711 from benoitc/docs/http2-changelog
• 5bf237c http2: require gunicorn_h1c 0.6.9 and drop the upgrade body workaround
• 7cf0338 test: skip the fast-parser cases when gunicorn_h1c is absent
• Additional commits viewable in compare view

Updates kubernetes to 36.0.3

Release notes

Sourced from kubernetes's releases.

Kubernetes Python Client v36.0.3 Stable Release

Getting started:

pip install --pre --upgrade kubernetes

Or from source, download attached zip file, then

unzip client-python-v36.0.3.zip
cd client-python-v36.0.3
python setup-release.py install

Then follow examples in https://github.com/kubernetes-client/python/tree/release-36.0/examples

Changelog: https://github.com/kubernetes-client/python/blob/release-36.0/CHANGELOG.md

Changelog

Sourced from kubernetes's changelog.

v36.0.3

Kubernetes API Version: v1.36.2

Bug or Regression

• Fix Watch.stream selecting watch instead of follow when streaming pod logs.
• Start the leader election worker thread as a daemon so it does not block process shutdown.
• Fix readline_channel, readline_stdout and readline_stderr crashing with OverflowError when using the default timeout, and returning None when a timeout expires.
• Fix format_quantity returning imprecise, non-canonical values for the milli, micro and nano suffixes, and ignoring quantize=Decimal(0).

v36.0.2

Kubernetes API Version: v1.36.1

Uncategorized

• Restored backward compatibility for Configuration.auth_settings(): the legacy api_key['authorization'] lookup is honored as a fallback when api_key['BearerToken'] is not set, fixing 401 Unauthorized regressions seen after upgrading to v36.0.0 (#2595). (#2604, @​GK-07)

v36.0.1

Kubernetes API Version: v1.36.1

Bug or Regression

• Fix load_incluster_config() and load_kube_config() (sync and async, with a static token) so requests carry an Authorization header on kubernetes-client/python v36+. Without this fix, in-cluster pods upgrading to v36 silently send unauthenticated requests and the apiserver rejects them as system:anonymous. (#2585, @​Jmacek)

Deprecation

• Support new exec v5 websocket subprotocol (#2486, @​aojea)

v36.0.0

Kubernetes API Version: v1.36.1

v36.0.0b1

Kubernetes API Version: v1.36.1

Deprecation

• Support new exec v5 websocket subprotocol (#2486, @​aojea)

v36.0.0a3

Kubernetes API Version: v1.36.0

v36.0.0a2

Kubernetes API Version: v1.36.0

... (truncated)

Commits

• 67e7d9a Merge pull request #2628 from yliaog/automated-release-of-36.0.3-upstream-rel...
• 0b18b05 generated client change
• eedb17e update version constants for 36.0.3 release
• bd7a886 update changelog with release notes from master branch
• 63dee8d Fix format_quantity precision and emit canonical decimal output
• 14ae4f0 Update coverage requirement from >=4.0.3 to >=7.14.1
• 33f9bf5 Add tests for readline_channel default and expired timeout handling
• f72f921 Fix readline_channel crash and None return on default timeout
• bb887bb Fix leader election worker thread not running as daemon
• 675392c Bump codecov/codecov-action from 6.0.1 to 7.0.0
• Additional commits viewable in compare view

Updates pyyaml to 6.0.3

Release notes

Sourced from pyyaml's releases.

6.0.3

What's Changed

• Support for Python 3.14 and free-threading (experimental).

Full Changelog: yaml/pyyaml@6.0.2...6.0.3

Changelog

Sourced from pyyaml's changelog.

6.0.3 (2025-09-25)

• yaml/pyyaml#864 -- Support for Python 3.14 and free-threading (experimental)

6.0.2 (2024-08-06)

• yaml/pyyaml#808 -- Support for Cython 3.x and Python 3.13

6.0.1 (2023-07-18)

• yaml/pyyaml#702 -- pin Cython build dep to < 3.0

6.0 (2021-10-13)

• yaml/pyyaml#327 -- Change README format to Markdown
• yaml/pyyaml#483 -- Add a test for YAML 1.1 types
• yaml/pyyaml#497 -- fix float resolver to ignore . and ._
• yaml/pyyaml#550 -- drop Python 2.7
• yaml/pyyaml#553 -- Fix spelling of “hexadecimal”
• yaml/pyyaml#556 -- fix representation of Enum subclasses
• yaml/pyyaml#557 -- fix libyaml extension compiler warnings
• yaml/pyyaml#560 -- fix ResourceWarning on leaked file descriptors
• yaml/pyyaml#561 -- always require Loader arg to yaml.load()
• yaml/pyyaml#564 -- remove remaining direct distutils usage

5.4.1 (2021-01-20)

• yaml/pyyaml#480 -- Fix stub compat with older pyyaml versions that may unwittingly load it

5.4 (2021-01-19)

• yaml/pyyaml#407 -- Build modernization, remove distutils, fix metadata, build wheels, CI to GHA
• yaml/pyyaml#472 -- Fix for CVE-2020-14343, moves arbitrary python tags to UnsafeLoader
• yaml/pyyaml#441 -- Fix memory leak in implicit resolver setup
• yaml/pyyaml#392 -- Fix py2 copy support for timezone objects
• yaml/pyyaml#378 -- Fix compatibility with Jython

5.3.1 (2020-03-18)

• yaml/pyyaml#386 -- Prevents arbitrary code execution during python/object/new constructor

5.3 (2020-01-06)

• yaml/pyyaml#290 -- Use is instead of equality for comparing with None
• yaml/pyyaml#270 -- Fix typos and stylistic nit
• yaml/pyyaml#309 -- Fix up small typo
• yaml/pyyaml#161 -- Fix handling of slots
• yaml/pyyaml#358 -- Allow calling add_multi_constructor with None
• yaml/pyyaml#285 -- Add use of safe_load() function in README
• yaml/pyyaml#351 -- Fix reader for Unicode code points over 0xFFFF

... (truncated)

Commits

• 49790e7 Release 6.0.3 (#889)
• 41309b0 Release 6.0.2 (#819)
• dd9f0e1 6.0.2rc1 (#809)
• f5527a2 disable CI trigger on PR edits
• b4d80a7 Python 3.12 + musllinux_1_1_x86_64 wheel support
• c42fa3b 6.0.1 release
• ae08bdc block Cython 3.0+ as a build dep (#702)
• f873cfe Add python 3.11 support (#663)
• See full diff in compare view

Updates neo4j to 6.3.0

Release notes

Sourced from neo4j's releases.

Neo4j Python Driver 6.3.0

https://github.com/neo4j/neo4j-python-driver/wiki/6.x-changelog#630

Changelog

Sourced from neo4j's changelog.

Neo4j Driver Change Log (breaking/major changes only)

See also https://github.com/neo4j/neo4j-python-driver/wiki for a full changelog.

NEXT RELEASE

• No breaking or major changes.

Version 6.2 - 6.3

• No breaking or major changes.

Version 6.1

• Python 3.14 support added.

Version 6.0

• Python 3.7, 3.8, and 3.9 support has been dropped.
• Remove deprecated package alias neo4j-driver. Use pip install neo4j instead.
• Remove setup.py. Please use a recent enough packaging/build tool that supports pyproject.toml
• Remove deprecated modules:
  • neo4j.conf
  • neo4j.data
  • neo4j.meta
  • neo4j.packstream
  • neo4j.routing
  • neo4j.time.arithmetic
  • neo4j.time.clock_implementation
  • neo4j.time.hydration
  • neo4j.time.metaclasses
  • neo4j.work
  • neo4j.work.query
  • neo4j.work.summary
• Remove deprecated exports from neo4j:
  • log, Config, PoolConfig, SessionConfig, WorkspaceConfig (internal - no replacement)
  • SummaryNotificationPosition (use SummaryInputPosition instead)
• api.Version has been removed as it's unused now.
  ServerInfo.protocol_version now is a tuple[int, int] insteadof a api.Version. This should be drop-in replacement is most cases:
  • Version was a sup-type of tuple[int, int]
  • ServerInfo.protocol_version was already documented and typed as tuple[int, int]
  • Version's additional methods were undocumented and shouldn't have been used
• Changed errors raised under certain circumstances
  • ConfigurationError if the passed auth parameters is not valid (instead of AuthError)
    • This improves the differentiation between DriverError for client-side errors and Neo4jError for server-side errors.
  • access_mode configuration option
    • ValueError on invalid value (instead of ClientError)
    • Consistently check the value (also for non-routing drivers)
  • neo4j.exceptions.UnsupportedServerProduct if no common bolt protocol version could be negotiated with the server

... (truncated)

Commits

• 13769e4 Bump pyarrow to 26.0.0 (#1328)
• a047831 Prepare 6.3.0 (#1326)
• 43e74e4 Bump dependencies (#1327)
• 2fb4e1a Tests: apply windows specific event-loop work-around to all Python versions (...
• e97a122 Bolt 6.1: UUID type (#1308)
• 4deb1de Tests: fix deprecations (#1317)
• 671deee Make driver's default SSL context respect SSLKEYLOGFILE env var (#1312)
• 13fe8a2 Fix pyarrow import (#1316)
• 8f2b069 Fix async driver waiting for OS on closing half-open socket (#1311)
• 4ef0748 Tests: add unit tests without optional dependencies to test matrix (#1306)
• Additional commits viewable in compare view

Updates pytest to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

• #14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.
• #14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @​pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".
• #14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.
• #14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.

Commits

• cf470ec Prepare release version 9.1.1
• e0c8ce6 Merge pull request #14625 from pytest-dev/patchback/backports/9.1.x/a07c31a97...
• 1b82d16 Merge pull request #14624 from pytest-dev/patchback/backports/9.1.x/b375b79ec...
• 501c4bc Merge pull request #14596 from bluetech/doc-classmethod
• b61f588 Merge pull request #14622 from chrisburr/fix-14608-initial-conftest-test-subdir
• 9a567e0 [automated] Update plugin list (#14617) (#14618)
• ef8b299 Merge pull request #14620 from pytest-dev/patchback/backports/9.1.x/680f9f3ed...
• 66abd07 Merge pull request #14220 from bysiber/fix-stale-iexp-raisesgroup
• 79fbf93 Merge pull request #14612 from pytest-dev/patchback/backports/9.1.x/974ed48b6...
• 0d312eb Merge pull request #14611 from bluetech/parametrize-argvalues-typing
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions