chore(deps): bump the all-dependencies group in /autobot-infrastructure/shared/scripts with 3 updates

[dependabot]

Updates the requirements on docker, flask and flask-cors to permit the latest version.
Updates docker to 7.2.0

Release notes

Sourced from docker's releases.

7.2.0

Upgrade Notes

• docker.from_env() now honors the active Docker CLI context when DOCKER_HOST is not set.
  • This means the client may connect to the daemon selected by DOCKER_CONTEXT or the current context in ~/.docker/config.json, matching Docker CLI behavior more closely.
  • If your application relied on the previous default connection behavior, set DOCKER_HOST explicitly, set DOCKER_CONTEXT=default, or pass use_context=False to DockerClient.from_env().
• Added docker.from_context() / DockerClient.from_context() for explicitly creating a client from a Docker CLI context.

Features

• Added support for Docker contexts when creating the default client
• Added subpath support for volumes

Bugfixes

• Fixed exec_run documentation for the stream parameter
• Fixed image loading to avoid depending on the deprecated JSONMessage.error field
• Preserved the rotated unlock key in swarm integration tests
• Fixed SSL certificate generation in tests
• Fixed IPv6 integration tests by explicitly enabling IPv6 where required

Miscellaneous

• Updated tests for newer Docker Engine behavior
• CI and build updates

What's Changed

• tests/exec: expect 127 exit code for missing executable by @​laurazard in docker/docker-py#3290
• fixing doc for stream param in exec_run by @​yasonk in docker/docker-py#3292
• Bump default API version to 1.45 (Moby 26.0/26.1) by @​thaJeztah in docker/docker-py#3261
• Set a dummy-version if none set, and remove unused APT_MIRROR build-arg by @​thaJeztah in docker/docker-py#3267
• test_service_logs: stop testing experimental versions by @​thaJeztah in docker/docker-py#2442
• Makefile: fix circular reference for integration-dind by @​thaJeztah in docker/docker-py#3297
• image load: don't depend on deprecated JSONMessage.error field by @​thaJeztah in docker/docker-py#3307
• integration: test_create_volume_invalid_driver allow either 400 or 404 by @​thaJeztah in docker/docker-py#3296
• integration: adjust tests for omitted "OnBuild" by @​thaJeztah in docker/docker-py#3336
• Implement Subpath Support for Volumes in Docker-Py (#3243) by @​Khushiyant in docker/docker-py#3270
• tests: fix ssl generation by @​thaJeztah in docker/docker-py#3365
• test/integration: don't check for deprecated Networks field by @​thaJeztah in docker/docker-py#3362
• test: Skip from_env_unix tests if DOCKER_HOST is network socket by @​ricardobranco777 in docker/docker-py#3366
• test_connect_with_ipv6_address: enable IPv6 by @​robmry in docker/docker-py#3372
• test_create_with_ipv6_address: enable IPv6 by @​robmry in docker/docker-py#3373
• tests: Migrate off gpg2 and regenerate key ed25519 by @​vvoland in docker/docker-py#3399
• gha: Pin to digests by @​vvoland in docker/docker-py#3408
• Fix integration tests on non-amd64 hosts and add ARM64 CI by @​vvoland in docker/docker-py#3407
• integration/swarm: Preserve rotated unlock key by @​vvoland in docker/docker-py#3410
• [DKP-2535] Honour context if present for default client, add contexts support by @​ebriney in docker/docker-py#3401
• docs: 7.2.0 changelog by @​vvoland in docker/docker-py#3415

New Contributors

• @​laurazard made their first contribution in docker/docker-py#3290
• @​yasonk made their first contribution in docker/docker-py#3292
• @​ricardobranco777 made their first contribution in docker/docker-py#3366

... (truncated)

Commits

• 5ad5327 Merge pull request #3415 from vvoland/update-changelog
• d242230 docs: 7.2.0 changelog
• ba01cc7 Merge pull request #3401 from ebriney/client-from-context
• ae5dfe9 Merge pull request #3410 from vvoland/fix-flaky
• aa99999 integration/swarm: Preserve rotated unlock key
• 059d371 Merge pull request #3407 from vvoland/fix-arm64
• 9b4b9b8 gha: Add arm64 integration CI
• 9e9f8ff Skip tests incompatible with host architecture
• e0542d9 Merge pull request #3408 from vvoland/gha-pin
• 578a11d gha: Pin to digests
• Additional commits viewable in compare view

Updates flask to 3.1.3

Release notes

Sourced from flask's releases.

3.1.3

This is the Flask 3.1.3 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.3/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-3

• The session is marked as accessed for operations that only access the keys but not the values, such as in and len. GHSA-68rp-wp8r-4726

Changelog

Sourced from flask's changelog.

Version 3.1.3

Released 2026-02-18

• The session is marked as accessed for operations that only access the keys but not the values, such as in and len. :ghsa:68rp-wp8r-4726

Version 3.1.2

Released 2025-08-19

• stream_with_context does not fail inside async views. :issue:5774
• When using follow_redirects in the test client, the final state of session is correct. :issue:5786
• Relax type hint for passing bytes IO to send_file. :issue:5776

Version 3.1.1

Released 2025-05-13

• Fix signing key selection order when key rotation is enabled via SECRET_KEY_FALLBACKS. :ghsa:4grg-w6v8-c28g
• Fix type hint for cli_runner.invoke. :issue:5645
• flask --help loads the app and plugins first to make sure all commands are shown. :issue:5673
• Mark sans-io base class as being able to handle views that return AsyncIterable. This is not accurate for Flask, but makes typing easier for Quart. :pr:5659

Version 3.1.0

Released 2024-11-13

• Drop support for Python 3.8. :pr:5623
• Update minimum dependency versions to latest feature releases. Werkzeug >= 3.1, ItsDangerous >= 2.2, Blinker >= 1.9. :pr:5624,5633
• Provide a configuration option to control automatic option responses. :pr:5496
• Flask.open_resource/open_instance_resource and Blueprint.open_resource take an encoding parameter to use when opening in text mode. It defaults to utf-8. :issue:5504
• Request.max_content_length can be customized per-request instead of only through the MAX_CONTENT_LENGTH config. Added

... (truncated)

Commits

• 22d9247 release version 3.1.3
• 089cb86 Merge commit from fork
• c17f379 request context tracks session access
• 27be933 start version 3.1.3
• 4e652d3 Abort if the instance folder cannot be created (#5903)
• 3d03098 Abort if the instance folder cannot be created
• 407eb76 document using gevent for async (#5900)
• ac5664d document using gevent for async
• 4f79d5b Increase required flit_core version to 3.11 (#5865)
• fe3b215 Increase required flit_core version to 3.11
• Additional commits viewable in compare view

Updates flask-cors to 6.0.5

Release notes

Sourced from flask-cors's releases.

6.0.5

Supersedes 6.0.4

What's Changed

• Add MyPy Typing and modernize options parsing by @​corydolphin in corydolphin/flask-cors#409 (this broke strict type checking when using Blueprints)
• Restore Blueprint support in CORS type signatures (#410) by @​corydolphin in corydolphin/flask-cors#411

Full Changelog: corydolphin/flask-cors@6.0.3...6.0.5

Changelog

Sourced from flask-cors's changelog.

Change Log

Unreleased

• Fix mypy --strict rejecting CORS(blueprint) / init_app(blueprint). The app parameter is now typed as Flask | Blueprint | None, restoring Blueprint support broken in 6.0.4 (#410). A type-checking regression test guards this going forward.
• Add full type annotations and a py.typed marker. The package now passes mypy --strict, checked in CI.
• Type the keyword arguments to CORS, init_app, and cross_origin so invalid options are caught by type checkers.
• Resolve options into a frozen internal dataclass instead of a plain dict.
• Invalid regular expressions now raise instead of being silently ignored.

4.0.1

Security

• Address CVE-2024-1681 which is a log injection vulnerability when the log level is set to debug by @​aneshujevic in corydolphin/flask-cors#351

4.0.0

• Remove support for Python versions older than 3.8 by @​WAKayser in corydolphin/flask-cors#330
• Add GHA tooling by @​corydolphin in corydolphin/flask-cors#331

3.1.01

• Include examples to specify that schema and port must be included in … by @​YPCrumble in corydolphin/flask-cors#294
• two small changes to the documentation, based on issue #290 by @​bbbart in corydolphin/flask-cors#291
• Fix typo by @​sunarch in corydolphin/flask-cors#304
• FIX: typo in CSRF by @​sattamjh in corydolphin/flask-cors#315
• Test against recent Python versions by @​pylipp in corydolphin/flask-cors#314
• Correct spelling mistakes by @​EdwardBetts in corydolphin/flask-cors#311
• 'Access-Control-Allow-Private-Network = true' header for http response by @​chelo-kjml in corydolphin/flask-cors#318
• docs: Fix a few typos by @​timgates42 in corydolphin/flask-cors#323
• [Docs] Fix typo in configuration documentation by @​sachit-shroff in corydolphin/flask-cors#316

3.0.10

Adds support for PPC64 and ARM64 builds for distribution. Thanks @​sreekanth370

3.0.9

Security

• Escape path before evaluating resource rules (thanks to Colby Morgan). Prior to this, flask-cors incorrectly evaluated CORS resource matching before path expansion. E.g. "/api/../foo.txt" would incorrectly match resources for "/api/*" whereas the path actually expands simply to "/foo.txt"

3.0.8

Fixes : DeprecationWarning: Using or importing the ABCs from 'collections' in Python 3.7. Thank you @​juanmaneo and @​jdevera for the contribution.

3.0.7

Updated logging.warn to logging.warning (#234) Thanks Vaibhav

3.0.6

Manual error in release process. Identical contents at 3.0.5.

3.0.5

Fixes incorrect handling of regexes containing [, and a few other special characters. Fixes Issue #212

... (truncated)

Commits

• 91ebc49 Typing Hotfix: support blueprints in the type system
• d601665 Add strict MyPy Typing
• c8e8871 Harden release publishing workflow (#406)
• e1d4034 Derive package version from git tag via setuptools-scm (#405)
• fa55dcb Update license pyproject.toml (#395)
• a5003f3 Fix README file extension in pyproject.toml (#386)
• 4ad56d6 Fix regex sorting issue from #391 (#392)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: cf19367c-f44d-4897-a614-1bd68b3be83f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Notice: 29 open PRs — past the runaway threshold (25)

There is no PR queue limit, and this is not a request to defer this PR. Work proceeds one issue at a time without a cap on open PRs; review capacity is the constraint.

This notice only means the count is high enough to be worth a glance for a runaway — something opening PRs in a loop, or a merge pipeline that has stalled so nothing is draining.

Currently open:

• chore(deps): bump the all-dependencies group in /autobot-tts-worker with 2 updates #16587 chore(deps): bump the all-dependencies group in /autobot-tts-worker with 2 updates
• chore(deps): bump mcp from 2.1.1 to 2.2.0 in /autobot-infrastructure/shared/mcp/tools/knowledge-base-mcp in the all-dependencies group #16586 chore(deps): bump mcp from 2.1.1 to 2.2.0 in /autobot-infrastructure/shared/mcp/tools/knowledge-base-mcp in the all-dependencies group
• chore(deps): bump the all-dependencies group in /autobot-infrastructure/shared/docker/ai-stack with 5 updates #16585 chore(deps): bump the all-dependencies group in /autobot-infrastructure/shared/docker/ai-stack with 5 updates
• chore(deps): bump the all-dependencies group with 11 updates #16584 chore(deps): bump the all-dependencies group with 11 updates
• chore(deps): update numpy requirement from <3.0.0,>=2.5.2 to >=2.5.3,<3.0.0 in /autobot-backend/code_analysis in the all-dependencies group #16583 chore(deps): update numpy requirement from <3.0.0,>=2.5.2 to >=2.5.3,<3.0.0 in /autobot-backend/code_analysis in the all-dependencies group
• chore(deps): update numpy requirement from <3.0.0,>=2.5.2 to >=2.5.3,<3.0.0 in /autobot-npu-worker in the all-dependencies group #16581 chore(deps): update numpy requirement from <3.0.0,>=2.5.2 to >=2.5.3,<3.0.0 in /autobot-npu-worker in the all-dependencies group
• chore(deps): bump the all-dependencies group in /autobot-infrastructure/autobot-npu-worker/docker with 2 updates #16578 chore(deps): bump the all-dependencies group in /autobot-infrastructure/autobot-npu-worker/docker with 2 updates
• chore(train): batch 1 CI vehicle — 13 PRs onto post-#16487 main [no-merge] #16577 chore(train): batch 1 CI vehicle — 13 PRs onto post-chore(git): rename Dev_new_gui to main and main to release across the repo (#16479) #16487 main [no-merge]
• chore(deps): bump the all-dependencies group with 3 updates #16576 chore(deps): bump the all-dependencies group with 3 updates
• chore(deps): bump the all-dependencies group in /autobot-frontend with 11 updates #16575 chore(deps): bump the all-dependencies group in /autobot-frontend with 11 updates
• chore(deps-dev): bump the all-dependencies group in /autobot-slm-frontend with 5 updates #16574 chore(deps-dev): bump the all-dependencies group in /autobot-slm-frontend with 5 updates
• chore(deps-dev): bump the oxlint group in /autobot-frontend with 2 updates #16573 chore(deps-dev): bump the oxlint group in /autobot-frontend with 2 updates
• chore(deps): bump the all-dependencies group across 1 directory with 9 updates #16572 chore(deps): bump the all-dependencies group in /autobot-backend with 9 updates
• docs(research): the disk-tiered MoE streaming analysis against llm_shared/optimization (#13030) #16571 docs(research): the disk-tiered MoE streaming analysis against llm_shared/optimization (umbrella(optimization): large-model inference on lean hardware is scaffolded but non-functional — 7 defects #13030)
• security(chat): finish #16545's PII/injection scan on /stream-ai-stack and resume (#16561) #16567 security(chat): finish security(chat): scan/redact PII and flag injection risk on every raw chat message (#16529, #16530) #16545's PII/injection scan on /stream-ai-stack and resume (security(chat): the #16545 PII/injection scan leaks a 200 on /stream-ai-stack and can be skipped there #16561)
• fix(knowledge): give _CPUBackend a non-recursive vector-search leaf (#15165) #16564 fix(knowledge): give _CPUBackend a non-recursive vector-search leaf (perf(api): /api/knowledge_base/search stops answering under concurrent load — hidden for the life of the file by a swallowed timeout #15165)
• fix(rag): wire GPU faiss onto an automated install, gated on GPU alone (#15163) #16560 fix(rag): wire GPU faiss onto an automated install, gated on GPU alone (fix(rag): FAISS-GPU vector search path never activates — faiss-gpu is installed by no automated path #15163)
• docs(research): add internal audit of LLM request-pipeline gaps #16559 docs(research): add internal audit of LLM request-pipeline gaps
• fix(infra): clear the debt blocking the last four branch-name swaps, and default install.sh to main (#16540) #16558 fix(infra): clear the debt blocking the last four branch-name swaps, and default install.sh to main (infra(git): fix the debt blocking the last five branch-name swaps (#16482 section 1) #16540)
• fix(config): register AUTOBOT_BROWSER_SERVICE_HOST/PORT, AUTOBOT_VNC_PORT (#15151) #16555 fix(config): register AUTOBOT_BROWSER_SERVICE_HOST/PORT, AUTOBOT_VNC_PORT (bug(config): AUTOBOT_PLAYWRIGHT_HOST and AUTOBOT_PLAYWRIGHT_API_PORT are documented but read by nothing #15151)
• fix(scripts): detect-environment.sh only selects files this repo tracks (#15143) #16553 fix(scripts): detect-environment.sh only selects files this repo tracks (bug(scripts): detect-environment.sh selects three .env files that do not exist #15143)
• fix(security): agent_config, sync and hardware-priority record the real caller, not "admin" (#16547, #16541) #16550 fix(security): agent_config, sync and hardware-priority record the real caller, not "admin" (fix(agents): api/agent_config.py records the audit trail as created_by="admin" for every actor #16547, bug(security): three agent-config writes record created_by="admin" instead of the real caller #16541)
• feat(llm): wire extractive prompt compression and enforce per-provider concurrency cap (#16526, #16527) #16546 feat(llm): wire extractive prompt compression and enforce per-provider concurrency cap (Wire the existing extractive prompt compressor into the live LLM completion path #16526, Enforce the existing per-provider LLM concurrency cap #16527)
• security(browser): validate the URL in capture_screenshot (#13204) #16544 security(browser): validate the URL in capture_screenshot (security(browser): send_to_browser_vm and playwright_service bypass the SSRF/DNS-rebind guard the other browser paths enforce #13204)
• fix(perf): re-derive Multimodal processor startup's budget post-#15297 (#16535) #16537 fix(perf): re-derive Multimodal processor startup's budget post-fix(ml): drop resume_download, removed from from_pretrained in transformers v5 (#15054) #15297 (perf(test): Multimodal processor startup budget still calibrated against #15054's broken (work-skipping) baseline #16535)
• fix(llm-shared): remove dead SemanticLLMCache, keep live semantic cache (#16528) #16536 fix(llm-shared): remove dead SemanticLLMCache, keep live semantic cache (Consolidate duplicate semantic LLM-response cache implementations #16528)
• feat(tooling): check_run_status gains a pending-with-age helper (#16126) #16534 feat(tooling): check_run_status gains a pending-with-age helper (docs(process): two review findings on MEASUREMENT_DISCIPLINE.md — family order and D's missing mechanism #16126)
• fix(files): conversation uploads accept PDF and GIF, not the truncated '.pd' and '.gi' (#16521) #16523 fix(files): conversation uploads accept PDF and GIF, not the truncated '.pd' and '.gi' (bug(files): conversation uploads reject every PDF and GIF because the allowlist says '.pd' and '.gi' #16521)
• fix(infra): consolidate the last 3 private TLS-cert-generation copies (#16020) #16522 fix(infra): consolidate the last 3 private TLS-cert-generation copies (nginx cannot start on a node with no TLS cert: five roles consume the shared keypair, four provision it #16020)

If the queue is draining normally, ignore this. Otherwise:

1. Check whether CI is dispatching at all — see the ci-dispatch-watchdog status on these PRs
2. Merge the ones whose CI has finished and review has passed: gh pr merge <number> --squash --delete-branch
3. Look for a loop opening near-identical PRs

Warn-only runaway detector — .github/workflows/pr-queue-gate.yml. It never blocks a merge.

[github-actions]

Retargeted to main (main-first flow, #11696). Dependabot security updates always open against the default branch; this workflow re-applies the retarget after every Dependabot push, so rebases cannot revert it.