From 0ce6f6ec6dbe842193ca1adf686bf887fd632f52 Mon Sep 17 00:00:00 2001
From: TPTBusiness <tpt.requests@pm.me>
Date: Tue, 21 Apr 2026 22:38:18 +0200
Subject: [PATCH] fix(deps): bump python-dotenv to >=1.2.2 (CVE symlink
 overwrite)

Resolves last open Dependabot alert: python-dotenv symlink following
in set_key allows arbitrary file overwrite via cross-device rename.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/requirements.txt b/requirements.txt
index 2889a0e2..f89bc147 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -37,7 +37,7 @@ tables
 tree-sitter-python
 tree-sitter
 
-python-dotenv
+python-dotenv>=1.2.2  # CVE: symlink following allows arbitrary file overwrite
 
 # infrastructure related.
 docker