Test commit (signing)

.ds.baseline

@@ -151,7 +151,7 @@
         "filename": ".github/workflows/daily_checks.yml",
         "hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
         "is_verified": false,
-        "line_number": 64,
+        "line_number": 63,
         "is_secret": false
       },
       {
@@ -159,7 +159,7 @@
         "filename": ".github/workflows/daily_checks.yml",
         "hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
         "is_verified": false,
-        "line_number": 80,
+        "line_number": 79,
         "is_secret": false
       }
     ],
@@ -374,5 +374,5 @@
       }
     ]
   },
-  "generated_at": "2026-03-26T17:19:11Z"
+  "generated_at": "2025-09-11T16:22:46Z"
 }

.github/actions/setup-project/action.yml

@@ -15,7 +15,7 @@ runs:
         python-version: "3.13.2"
     - name: Install poetry
       shell: bash
-      run: pip install poetry==2.3.4
+      run: pip install poetry==2.1.3
     - name: Install poetry export
       shell: bash
       run: poetry self add poetry-plugin-export

.github/dependabot.yml

@@ -3,19 +3,16 @@
 # Please see the documentation for all configuration options:
 # https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
 
-# Note: Setting open-pull-requests-limit to 0 disables automatic version update PRs.
-# Security updates are still active and managed separately in repository settings under
-# "Security & analysis" > "Dependabot security updates"
-
 version: 2
 updates:
   - package-ecosystem: "pip" # See documentation for possible values
     directory: "/" # Location of package manifests
     schedule:
       interval: "daily"
-    open-pull-requests-limit: 0 # Disable version update PRs; security updates still active
     labels:
       - "dependabot" # Custom label to identify Dependabot PRs
+    assignees:
+      - "alexjanousekGSA"
     ignore:
       # gevent 25.8+ breaks Celery/Kombu compatibility (potentially)
       - dependency-name: "gevent"

.github/workflows/checks.yml

@@ -93,7 +93,6 @@ jobs:
           inputs: requirements.txt
           ignore-vulns: |
             PYSEC-2023-312
-            CVE-2026-4539
 
   static-scan:
     runs-on: ubuntu-latest

.github/workflows/daily_checks.yml

@@ -32,7 +32,6 @@ jobs:
           inputs: requirements.txt
           ignore-vulns: |
             PYSEC-2023-312
-            CVE-2026-4539
       - name: Upload pip-audit artifact
         uses: actions/upload-artifact@v4
         with:

.github/workflows/deploy.yml

@@ -113,6 +113,6 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ github.event.workflow_run.conclusion == 'failure' }}
     steps:
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@v6
         with:
           script: core.setFailed('Checks failed, not deploying')

README.md

@@ -6,7 +6,7 @@ This project is the core of [Notify.gov](https://notify-demo.app.cloud.gov).
 It's cloned from the brilliant work of the team at
 [GOV.UK Notify](https://github.com/alphagov/notifications-api), cheers!
 
-This repo contains:
+This repo contains  :
 
 - A public-facing REST API for Notify.gov, which teams can integrate with using
   [API clients built by UK](https://www.notifications.service.gov.uk/documentation).

pyproject.toml

@@ -34,15 +34,15 @@ flask-sqlalchemy = "^3.1.1"
 gunicorn = {version = "==25.1.0", extras = ["gevent"]}
 iso8601 = "==2.1.0"
 jsonschema = {version = "==4.26.0", extras = ["format"]}
-lxml = "==6.1.0"
+lxml = "==6.0.2"
 marshmallow = "^4.2.2"
 marshmallow-sqlalchemy = "^1.4.2"
 newrelic = "^11.5.0"
 packaging = "==26.0"
 poetry-dotenv-plugin = "==0.2.0"
 psycopg2-binary = "==2.9.11"
-pyjwt = "==2.12.0"
-python-dotenv = "==1.2.2"
+pyjwt = "==2.10.1"
+python-dotenv = "==1.2.1"
 sqlalchemy = "==2.0.47"
 werkzeug = "^3.1.5"
 faker = "^40.5.1"
@@ -56,39 +56,38 @@ python-json-logger = "^4.0.0"
 regex = "^2026.2.19"
 shapely = "^2.1.2"
 smartypants = "^2.0.1"
-mistune = "^3.2.1"
+mistune = "^3.2.0"
 blinker = "^1.9.0"
-cryptography = "^46.0.7"
+cryptography = "^46.0.5"
 idna = "^3.11"
 jmespath = "^1.1.0"
 markupsafe = "^3.0.3"
-mako = "^1.3.12"
 pycparser = "^3.0"
 python-dateutil = "^2.9.0.post0"
 pyyaml = "^6.0.3"
-s3transfer = "^0.16.0"
+s3transfer = "^0.13.1"
 six = "^1.16.0"
 urllib3 = "^2.6.3"
 webencodings = "^0.5.1"
 itsdangerous = "^2.2.0"
 jinja2 = "^3.1.6"
 redis = "^6.4.0"
-requests = "^2.33.0"
-virtualenv = "^21.1.0"
+requests = "^2.32.5"
+virtualenv = "^21.0.0"
 marshmallow-enum = "^1.5.1"
-awscli = "^1.44.38"
+awscli = "^1.40.36"
 typing-extensions = "^4.15.0"
-aiohttp = "^3.13.4"
+aiohttp = "^3.13.3"
 pytest = "^9.0.2"
 filelock = ">=3.20.3"
-pyasn1 = ">=0.6.3"
+pyasn1 = ">=0.6.2"
 jaraco-context = ">=6.1.0"
 wheel = ">=0.46.2"
 
 
 [tool.poetry.group.dev.dependencies]
 bandit = "*"
-black = "^26.3.1"
+black = "^26.1.0"
 cyclonedx-python-lib = "^11.6.0"
 cloudfoundry-client = "*"
 exceptiongroup = "==1.3.1"

tests/app/authentication/test_authentication.py

@@ -238,11 +238,12 @@ def test_decode_jwt_token_returns_error_with_no_secrets(client):
     assert exc.value.short_message == "Invalid token: API key not found"
 
 
+@pytest.mark.parametrize("service_id", ["not-a-valid-id", 1234])
 def test_requires_auth_should_not_allow_service_id_with_the_wrong_data_type(
-    client, service_jwt_secret
+    client, service_jwt_secret, service_id
 ):
     token = create_jwt_token(
-        client_id="not-a-valid-id",
+        client_id=service_id,
         secret=service_jwt_secret,
     )
 
@@ -255,16 +256,6 @@ def test_requires_auth_should_not_allow_service_id_with_the_wrong_data_type(
     )
 
 
-def test_requires_auth_should_not_allow_service_id_with_a_non_string(
-    client, service_jwt_secret
-):
-    with pytest.raises(TypeError):
-        create_jwt_token(
-            client_id=1234,
-            secret=service_jwt_secret,
-        )
-
-
 def test_requires_auth_returns_error_when_service_doesnt_exist(client, sample_api_key):
     # get service ID and secret the wrong way around
     token = create_jwt_token(