Update README with archive warning

Added warning about repository being archived and outdated.

.ds.baseline

@@ -133,7 +133,7 @@
         "filename": ".github/workflows/checks.yml",
         "hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
         "is_verified": false,
-        "line_number": 28,
+        "line_number": 29,
         "is_secret": false
       },
       {
@@ -141,7 +141,7 @@
         "filename": ".github/workflows/checks.yml",
         "hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
         "is_verified": false,
-        "line_number": 45,
+        "line_number": 46,
         "is_secret": false
       }
     ],
@@ -151,7 +151,7 @@
         "filename": ".github/workflows/daily_checks.yml",
         "hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
         "is_verified": false,
-        "line_number": 63,
+        "line_number": 66,
         "is_secret": false
       },
       {
@@ -159,7 +159,7 @@
         "filename": ".github/workflows/daily_checks.yml",
         "hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
         "is_verified": false,
-        "line_number": 79,
+        "line_number": 82,
         "is_secret": false
       }
     ],
@@ -374,5 +374,5 @@
       }
     ]
   },
-  "generated_at": "2025-09-11T16:22:46Z"
+  "generated_at": "2026-06-02T14:59:28Z"
 }

.github/actions/setup-project/action.yml

@@ -10,12 +10,12 @@ runs:
         && sudo apt-get install -y --no-install-recommends \
         libcurl4-openssl-dev
     - name: Set up Python 3.13.2
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v6
       with:
         python-version: "3.13.2"
     - name: Install poetry
       shell: bash
-      run: pip install poetry==2.1.3
+      run: pip install poetry==2.3.4
     - name: Install poetry export
       shell: bash
       run: poetry self add poetry-plugin-export

.github/dependabot.yml

@@ -3,16 +3,19 @@
 # Please see the documentation for all configuration options:
 # https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
 
+# Note: Setting open-pull-requests-limit to 0 disables automatic version update PRs.
+# Security updates are still active and managed separately in repository settings under
+# "Security & analysis" > "Dependabot security updates"
+
 version: 2
 updates:
   - package-ecosystem: "pip" # See documentation for possible values
     directory: "/" # Location of package manifests
     schedule:
       interval: "daily"
+    open-pull-requests-limit: 0 # Disable version update PRs; security updates still active
     labels:
       - "dependabot" # Custom label to identify Dependabot PRs
-    assignees:
-      - "alexjanousekGSA"
     ignore:
       # gevent 25.8+ breaks Celery/Kombu compatibility (potentially)
       - dependency-name: "gevent"

.github/workflows/adr-accepted.yml

@@ -1,83 +0,0 @@
-name: ADR accepted
-
-on:
-  issues:
-    types:
-      - closed
-
-permissions:
-  contents: read
-
-jobs:
-  accept:
-    runs-on: ubuntu-latest
-    steps:
-
-    - name: check for tags
-      if: "${{ !contains(github.event.issue.labels.*.name, 'ADR: accepted' )}}"
-      shell: bash
-      run: exit 0
-
-    - name: checkout main branch
-      uses: actions/checkout@v4
-      with:
-        ref: main
-        ssh-key: ${{ secrets.SSH_PRIVATE_KEY }}
-
-    - name: get ADR number
-      id: next
-      shell: bash
-      run: |
-        mkdir -p docs/adrs
-        LAST_ADR=$(ls docs/adrs/*.md | grep -Eo "/[0-9]+-" | sort | tail -n1 | grep -Eo "[0-9]+")
-        LAST_ADR=$(echo "$LAST_ADR" | sed -E 's/^0+//')
-        NEXT_ADR=$(($LAST_ADR + 1))
-        NEXT_ADR=$(printf "%04i" "$NEXT_ADR")
-        echo "number=$NEXT_ADR" >> "$GITHUB_OUTPUT"
-
-    - name: get date
-      id: date
-      shell: bash
-      run: echo "date=$(date +'%B %d, %Y')" >> "$GITHUB_OUTPUT"
-
-    - name: build filename
-      id: filename
-      shell: bash
-      run: |
-        SLUG=$(printf '%q\n' "${{ github.event.issue.title }}" | tr A-Z a-z)
-        SLUG=$(printf '%q\n' "$SLUG" | iconv -c -t ascii//TRANSLIT)
-        SLUG=$(printf '%q\n' "$SLUG" | sed -E 's/[^a-z0-9]+/-/g' | sed -E 's/-+/-/g' | sed -E 's/^-+|-+$//g')
-
-        FILENAME="docs/adrs/${{ steps.next.outputs.number }}-$SLUG.md"
-        echo "slug=$SLUG" >> "$GITHUB_OUTPUT"
-        echo "filename=$FILENAME" >> "$GITHUB_OUTPUT"
-
-    - name: write the ADR
-      uses: DamianReeves/write-file-action@v1.3
-      with:
-        path: ${{ steps.filename.outputs.filename }}
-        write-mode: overwrite
-        contents: |
-          # ${{ github.event.issue.title }}
-
-          Status: Accepted
-          Date: ${{ steps.date.outputs.date }}
-
-          ${{ github.event.issue.body }}
-
-    - name: branch, commit, and open PR
-      shell: bash
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-        BRANCH="adr/auto/${{ steps.filename.outputs.slug }}"
-        git config --global user.email "tts@gsa.gov"
-        git config --global user.name "Notify ADR Automation"
-        git checkout -b $BRANCH
-        git add docs/adrs/*.md
-        git commit -m "add ADR ${{ steps.next.outputs.number }}: ${{ github.event.issue.title }}"
-        git push -f origin $BRANCH
-        gh pr create \
-          --title "Add ADR ${{ steps.next.outputs.number }} to the repo" \
-          --body "This pull request was opened automatically because #${{ github.event.issue.number }} was closed after being marked as an approved ADR. It contains a markdown file capturing the ADR body at the time the issue was closed. Please verify that the markdown is correct before merging!" || true
-        gh pr merge $BRANCH --auto --squash || true

.github/workflows/checks.yml

@@ -14,6 +14,7 @@ env:
   WERKZEUG_DEBUG_PIN: off
   REDIS_ENABLED: 0
   AWS_US_TOLL_FREE_NUMBER: "+18556438890"
+  ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
 
 jobs:
 
@@ -37,7 +38,7 @@ jobs:
           - 5432:5432
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - uses: ./.github/actions/setup-project
     - name: Install application dependencies
       run: make bootstrap
@@ -70,7 +71,7 @@ jobs:
     runs-on: ubuntu-latest
     environment: staging
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: ./.github/actions/setup-project
       - name: Install poetry packages
         run: poetry install
@@ -84,7 +85,7 @@ jobs:
   pip-audit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: ./.github/actions/setup-project
       - name: Create requirements.txt
         run: poetry export --output requirements.txt
@@ -93,11 +94,12 @@ jobs:
           inputs: requirements.txt
           ignore-vulns: |
             PYSEC-2023-312
+            CVE-2026-4539
 
   static-scan:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: ./.github/actions/setup-project
       - name: Install bandit
         run: pip install bandit
@@ -122,7 +124,7 @@ jobs:
           # Maps tcp port 5432 on service container to the host
           - 5432:5432
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: ./.github/actions/setup-project
       - name: Install application dependencies
         run: make bootstrap
@@ -137,7 +139,7 @@ jobs:
         env:
           SQLALCHEMY_DATABASE_TEST_URI: postgresql://user:password@localhost:5432/test_notification_api
       - name: Run OWASP API Scan
-        uses: zaproxy/action-api-scan@v0.9.0
+        uses: zaproxy/action-api-scan@v0.10.0
         with:
           docker_name: 'ghcr.io/zaproxy/zaproxy:weekly'
           target: 'http://localhost:6011/docs/openapi.yml'

.github/workflows/codeql.yml

@@ -56,7 +56,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL

.github/workflows/daily_checks.yml

@@ -19,11 +19,13 @@ env:
   REDIS_ENABLED: 0
   AWS_US_TOLL_FREE_NUMBER: "+18556438890"
 
+
+
 jobs:
   pip-audit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: ./.github/actions/setup-project
       - name: Create requirements.txt
         run: poetry export --output requirements.txt
@@ -32,8 +34,9 @@ jobs:
           inputs: requirements.txt
           ignore-vulns: |
             PYSEC-2023-312
+            CVE-2026-4539
       - name: Upload pip-audit artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: pip-audit-report
           path: /tmp/pip-audit-output.txt
@@ -41,14 +44,14 @@ jobs:
   static-scan:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: ./.github/actions/setup-project
       - name: Install bandit
         run: pip install bandit
       - name: Run scan
         run: bandit -r app/ -f txt -o /tmp/bandit-output.txt --confidence-level medium
       - name: Upload bandit artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: bandit-report
           path: /tmp/bandit-output.txt
@@ -71,7 +74,7 @@ jobs:
           # Maps tcp port 5432 on service container to the host
           - 5432:5432
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: ./.github/actions/setup-project
       - name: Install application dependencies
         run: make bootstrap
@@ -86,7 +89,7 @@ jobs:
         env:
           SQLALCHEMY_DATABASE_TEST_URI: postgresql://user:password@localhost:5432/test_notification_api
       - name: Run OWASP API Scan
-        uses: zaproxy/action-api-scan@v0.9.0
+        uses: zaproxy/action-api-scan@v0.10.0
         with:
           docker_name: 'ghcr.io/zaproxy/zaproxy:weekly'
           target: 'http://localhost:6011/docs/openapi.yml'

.github/workflows/deploy-demo.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     environment: demo
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
       with:
         fetch-depth: 2
 

.github/workflows/deploy-prod.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     environment: production
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
       with:
         fetch-depth: 2
 

.github/workflows/deploy.yml

@@ -18,7 +18,7 @@ jobs:
 
     environment: staging
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
       with:
         fetch-depth: 2
 
@@ -113,6 +113,6 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ github.event.workflow_run.conclusion == 'failure' }}
     steps:
-      - uses: actions/github-script@v6
+      - uses: actions/github-script@v9
         with:
           script: core.setFailed('Checks failed, not deploying')

.github/workflows/drift.yml

@@ -13,7 +13,7 @@ jobs:
     environment: staging
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       # Looks like we need to install Terraform ourselves now!
       # https://github.com/actions/runner-images/issues/10796#issuecomment-2417064348
@@ -50,7 +50,7 @@ jobs:
   #   environment: demo
   #   steps:
   #     - name: Checkout
-  #       uses: actions/checkout@v4
+  #       uses: actions/checkout@v6
   #       with:
   #         ref: 'production'
 
@@ -89,7 +89,7 @@ jobs:
     environment: production
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: 'production'
 

.github/workflows/terraform-demo.yml

@@ -16,7 +16,7 @@ jobs:
     environment: demo
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       # Looks like we need to install Terraform ourselves now!
       # https://github.com/actions/runner-images/issues/10796#issuecomment-2417064348
@@ -59,7 +59,7 @@ jobs:
 
       # inspiration: https://learn.hashicorp.com/tutorials/terraform/github-actions#review-actions-workflow
       - name: Update PR
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         # we would like to update the PR even when a prior step failed
         if: ${{ always() }}
         with:

.github/workflows/terraform-production.yml

@@ -16,7 +16,7 @@ jobs:
     environment: production
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       # Looks like we need to install Terraform ourselves now!
       # https://github.com/actions/runner-images/issues/10796#issuecomment-2417064348
@@ -59,7 +59,7 @@ jobs:
 
       # inspiration: https://learn.hashicorp.com/tutorials/terraform/github-actions#review-actions-workflow
       - name: Update PR
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         # we would like to update the PR even when a prior step failed
         if: ${{ always() }}
         with:

.github/workflows/terraform-staging.yml

@@ -16,7 +16,7 @@ jobs:
     environment: staging
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       # Looks like we need to install Terraform ourselves now!
       # https://github.com/actions/runner-images/issues/10796#issuecomment-2417064348
@@ -60,7 +60,7 @@ jobs:
 
       # inspiration: https://learn.hashicorp.com/tutorials/terraform/github-actions#review-actions-workflow
       - name: Update PR
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         # we would like to update the PR even when a prior step failed
         if: ${{ always() }}
         with:

README.md

@@ -2,11 +2,15 @@
 
 # Notify.gov API
 
+> [!WARNING]
+>
+> This repository has been archived and dependencies are out of date. If being revived in the future, we recommend starting from https://workshop.cloud.gov/cloud-gov/notifications/api which has had some updates completed.
+
 This project is the core of [Notify.gov](https://notify-demo.app.cloud.gov).
 It's cloned from the brilliant work of the team at
 [GOV.UK Notify](https://github.com/alphagov/notifications-api), cheers!
 
-This repo contains  :
+This repo contains:
 
 - A public-facing REST API for Notify.gov, which teams can integrate with using
   [API clients built by UK](https://www.notifications.service.gov.uk/documentation).

pyproject.toml

@@ -19,11 +19,12 @@ celery = {version = "==5.6.2", extras = ["redis"]}
 certifi = ">=2022.12.7"
 cffi = "==2.0.0"
 charset-normalizer = "^3.4.4"
-click = "==8.3.1"
+click = "^8.3.3"
 click-didyoumean = "==0.3.1"
 click-plugins = "==1.1.1.2"
 click-repl = "==0.3.0"
 deprecated = "==1.3.1"
+dulwich = "^1.2.5"
 gevent = "==25.5.1"
 expiringdict = "==1.2.2"
 flask = "~=3.1"
@@ -34,20 +35,20 @@ flask-sqlalchemy = "^3.1.1"
 gunicorn = {version = "==25.1.0", extras = ["gevent"]}
 iso8601 = "==2.1.0"
 jsonschema = {version = "==4.26.0", extras = ["format"]}
-lxml = "==6.0.2"
+lxml = "==6.1.0"
 marshmallow = "^4.2.2"
 marshmallow-sqlalchemy = "^1.4.2"
 newrelic = "^11.5.0"
 packaging = "==26.0"
 poetry-dotenv-plugin = "==0.2.0"
 psycopg2-binary = "==2.9.11"
-pyjwt = "==2.10.1"
-python-dotenv = "==1.2.1"
+pyjwt = "==2.13.0"
+python-dotenv = "==1.2.2"
 sqlalchemy = "==2.0.47"
 werkzeug = "^3.1.5"
 faker = "^40.5.1"
 async-timeout = "^5.0.1"
-bleach = "^6.3.0"
+bleach = "^6.4.0"
 geojson = "^3.2.0"
 numpy = "^2.4.2"
 ordered-set = "^4.1.0"
@@ -56,38 +57,39 @@ python-json-logger = "^4.0.0"
 regex = "^2026.2.19"
 shapely = "^2.1.2"
 smartypants = "^2.0.1"
-mistune = "^3.2.0"
+mistune = "^3.3.0"
 blinker = "^1.9.0"
-cryptography = "^46.0.5"
-idna = "^3.11"
+cryptography = "^50.0.0"
+idna = "^3.15"
 jmespath = "^1.1.0"
 markupsafe = "^3.0.3"
+mako = "^1.3.12"
 pycparser = "^3.0"
 python-dateutil = "^2.9.0.post0"
 pyyaml = "^6.0.3"
-s3transfer = "^0.13.1"
+s3transfer = "^0.16.0"
 six = "^1.16.0"
 urllib3 = "^2.6.3"
 webencodings = "^0.5.1"
 itsdangerous = "^2.2.0"
 jinja2 = "^3.1.6"
 redis = "^6.4.0"
-requests = "^2.32.5"
-virtualenv = "^21.0.0"
+requests = "^2.33.0"
+virtualenv = "^21.1.0"
 marshmallow-enum = "^1.5.1"
-awscli = "^1.40.36"
+awscli = "^1.45.28"
 typing-extensions = "^4.15.0"
-aiohttp = "^3.13.3"
+aiohttp = "^3.14.3"
 pytest = "^9.0.2"
 filelock = ">=3.20.3"
-pyasn1 = ">=0.6.2"
+pyasn1 = ">=0.6.4"
 jaraco-context = ">=6.1.0"
 wheel = ">=0.46.2"
 
 
 [tool.poetry.group.dev.dependencies]
 bandit = "*"
-black = "^26.1.0"
+black = "^26.3.1"
 cyclonedx-python-lib = "^11.6.0"
 cloudfoundry-client = "*"
 exceptiongroup = "==1.3.1"

tests/app/authentication/test_authentication.py

@@ -238,12 +238,11 @@ def test_decode_jwt_token_returns_error_with_no_secrets(client):
     assert exc.value.short_message == "Invalid token: API key not found"
 
 
-@pytest.mark.parametrize("service_id", ["not-a-valid-id", 1234])
 def test_requires_auth_should_not_allow_service_id_with_the_wrong_data_type(
-    client, service_jwt_secret, service_id
+    client, service_jwt_secret
 ):
     token = create_jwt_token(
-        client_id=service_id,
+        client_id="not-a-valid-id",
         secret=service_jwt_secret,
     )
 
@@ -256,6 +255,16 @@ def test_requires_auth_should_not_allow_service_id_with_the_wrong_data_type(
     )
 
 
+def test_requires_auth_should_not_allow_service_id_with_a_non_string(
+    client, service_jwt_secret
+):
+    with pytest.raises(TypeError):
+        create_jwt_token(
+            client_id=1234,
+            secret=service_jwt_secret,
+        )
+
+
 def test_requires_auth_returns_error_when_service_doesnt_exist(client, sample_api_key):
     # get service ID and secret the wrong way around
     token = create_jwt_token(