chore: upgrade potentially vulnerable libs

carbonserver/carbonserver/api/services/auth_providers/oidc_auth_provider.py

@@ -1,7 +1,7 @@
 """
 OIDC Authentication Provider Implementation
 
-This module provides a generic OIDC authentication provider implementation using fastapi-oidc.
+This module provides a generic OIDC authentication provider implementation.
 It can work with any OIDC-compliant provider (Keycloak, Auth0, etc.).
 """
 

carbonserver/pyproject.toml

@@ -24,8 +24,7 @@ dependencies = [
     # which breaks fastapi-pagination (up to 0.15.15). Lift once it is fixed upstream.
     # See https://github.com/uriyyo/fastapi-pagination/issues/1990
     "fastapi<0.140.5,>=0.138.1",
-    "fastapi[standard]",
-    "httpx2>=2.0.0",
+    "httpx<1.0.0",
     "pydantic[email]>=2.0.0,<3.0.0",
     "pydantic-settings>=2.14.2,<3.0.0",
     "psycopg2-binary<3.0.0",
@@ -37,10 +36,11 @@ dependencies = [
     "psutil",
     "rapidfuzz",
     "PyJWT",
-    "fastapi-oidc>=0.0.9",
     "authlib>=1.6.6",
     "joserfc>=1.0.0",
     "itsdangerous>=2.2.0",
+    # Alembic depends on Mako but does not currently require the CVE-fixed version.
+    "mako>=1.3.12",
 ]
 
 [project.optional-dependencies]

carbonserver/tests/api/integration/test_auth_cookie_flow.py

@@ -1,5 +1,5 @@
 """
-End-to-end auth flow against a running API using Fief + fastapi-oidc.
+End-to-end auth flow against a running API using Fief.
 
 Required environment variables (test is skipped if any is missing):
     CODECARBON_API_URL        Base API URL (e.g. https://api.dev/codecarbon/api)