From 178d7f0e4fd3a7a8185f621b800e770f7fcbdff8 Mon Sep 17 00:00:00 2001
From: xhdnoah <40939515+xhdnoah@users.noreply.github.com>
Date: Tue, 27 Oct 2026 07:42:19 +0000
Subject: [PATCH] fix(deps): pin Werkzeug >=3.1.7 to prevent vulnerable
 transitive resolution (#44868)

Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 api/pyproject.toml | 1 +
 api/uv.lock        | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/api/pyproject.toml b/api/pyproject.toml
index 6f0cef74169..85f820ef784 100644
--- a/api/pyproject.toml
+++ b/api/pyproject.toml
@@ -42,6 +42,7 @@ dependencies = [
     "opentelemetry-propagator-b3>=1.45.0,<2.0.0",
     "readabilipy==0.3.0",
     "resend>=2.27.0,<3.0.0",
+    "werkzeug>=3.1.7,<4.0.0",
     "zstandard==0.25.0",
     # Emerging: newer and fast-moving, use compatible pins
     "fastopenapi[flask]==0.7.0",
diff --git a/api/uv.lock b/api/uv.lock
index f3762a905cc..4cce98e4531 100644
--- a/api/uv.lock
+++ b/api/uv.lock
@@ -1440,6 +1440,7 @@ dependencies = [
     { name = "resend" },
     { name = "sendgrid" },
     { name = "sseclient-py" },
+    { name = "werkzeug" },
     { name = "zstandard" },
 ]
 
@@ -1730,6 +1731,7 @@ requires-dist = [
     { name = "resend", specifier = ">=2.27.0,<3.0.0" },
     { name = "sendgrid", specifier = ">=6.12.5,<7.0.0" },
     { name = "sseclient-py", specifier = ">=1.8.0,<2.0.0" },
+    { name = "werkzeug", specifier = ">=3.1.7,<4.0.0" },
     { name = "zstandard", specifier = "==0.25.0" },
 ]