deps: bump WsgiDAV to 4.3.5 (GHSA-p6gw-4frg-j7jw, GHSA-wxq4-cc2q-338q)

[katsugtgz]

Updates WsgiDAV to address GHSA-p6gw-4frg-j7jw and GHSA-wxq4-cc2q-338q.

Evidence:

• requirements.txt pinned WsgiDAV==4.3.3
• osv-scanner reported GHSA-p6gw-4frg-j7jw, GHSA-wxq4-cc2q-338q, and PYSEC-2026-3428 for wsgidav 4.3.3
• updated version: 4.3.5

Validation:

• osv-scanner no longer reports GHSA-p6gw-4frg-j7jw, GHSA-wxq-cc2q-338q, or PYSEC-2026-3428 after the update
• WsgiDAV==4.3.5 installs on the Dockerfile runtime (python:3.12-slim), no new transitive requirements

Scope: dependency/lockfile update only.

[ptbsare]

Hi @katsugtgz thanks！

This has been merged, and the Beta build has now succeeded. Could you help test it?

docker pull ghcr.io/ptbsare/anx-calibre-manager:aio-beta
docker pull ghcr.io/ptbsare/anx-calibre-manager:beta

Are these two images working properly?

If they work properly, I will publish a release.

[katsugtgz]

On it. give me a few moments.

[katsugtgz]

Tested both images. Results:

• beta and aio-beta both ship WsgiDAV 4.3.5, pinned in requirements.txt
• Fresh deploy: setup wizard, admin creation, login, and web UI all work
• WebDAV (the changed component): PROPFIND returns 207, PUT/GET roundtrip keeps content, per-user folder isolation still enforced (root path returns 401)
• AIO: built-in calibre-server starts, library init adds the #library and #readdate columns, no errors in the logs

Good to publish the release. Thanks!

[ptbsare]

OK, sure. The new release has been published. Thanks!
https://github.com/ptbsare/anx-calibre-manager/releases/tag/v1.13.12