From b141694fcceaad3fb44aeb42b2aaf8b42471fe71 Mon Sep 17 00:00:00 2001
From: snyk-bot <snyk-bot@snyk.io>
Date: Tue, 17 Mar 2026 18:48:00 +0000
Subject: [PATCH] fix: requirements.txt to reduce vulnerabilities

The following vulnerabilities are fixed by pinning transitive dependencies:
- https://snyk.io/vuln/SNYK-PYTHON-AUTHLIB-15674451
- https://snyk.io/vuln/SNYK-PYTHON-AUTHLIB-15674452
- https://snyk.io/vuln/SNYK-PYTHON-AUTHLIB-15674453
- https://snyk.io/vuln/SNYK-PYTHON-PYASN1-15674561
- https://snyk.io/vuln/SNYK-PYTHON-PYOPENSSL-15674458
---
 requirements.txt | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/requirements.txt b/requirements.txt
index f2cd9e9..e394034 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -37,7 +37,7 @@ jsonpickle==2.0.0
 
 # Cryptography (older versions with known issues)
 cryptography==3.4.7
-pyOpenSSL==20.0.1
+pyOpenSSL==26.0.0
 paramiko==2.7.2
 
 # Authentication/JWT (vulnerable versions)
@@ -211,7 +211,7 @@ python-decouple==3.4
 
 # JWT and auth libraries
 python-jose==3.3.0
-authlib==0.15.4
+authlib==1.6.9
 
 # Excel/CSV processing
 openpyxl==3.0.7
@@ -320,3 +320,4 @@ prompt-toolkit==3.0.19
 backcall==0.2.0
 jedi==0.18.0
 parso==0.8.2
+pyasn1>=0.6.3 # not directly required, pinned by Snyk to avoid a vulnerability