deps(python): periodic dependency & security update

[qw-in]

periodic dependency & security update

[arcjet-review]

Arcjet Review — 🟢 Low Risk

Decision: Approved

Rationale: Small, well-scoped dependency version bumps in two example applications (examples/fastapi and examples/flask). Bumps arcjet 1.1.0→1.2.0, uvicorn 0.52.1→0.53.0, and gunicorn 26.0.0→26.2.0. Only pyproject.toml manifests are affected — no application code changes. The AnyIO advisory referenced in the second commit is presumably resolved via a transitive lockfile update not included in the filtered diff. No security-sensitive code paths, no secrets, no auth changes. Risk to consumers of the SDK is minimal since these are example apps.

Summary of Changes

Periodic dependency bumps in the Python example apps: arcjet 1.1.0→1.2.0 in both examples, uvicorn 0.52.1→0.53.0 in fastapi, and gunicorn 26.0.0→26.2.0 in flask.

Escalation Triggers

• Dependency Changes: pyproject.toml modified in examples/fastapi and examples/flask

Notes

The second commit subject references an AnyIO security advisory fix, but anyio does not appear as a direct dependency in the diff — the fix presumably comes through a transitive update in a lockfile outside the filtered diff. Not flagged as inaccurate since the direct-dependency bumps here can legitimately pull in a patched anyio.

Path filtering: 2 files excluded by ignore paths. 2 of 4 files included in review.

_{Review: f8d32930 | Model: anthropic/claude-opus-4-7 | Powered by Arcjet Review}