Bump flask-cors from 4.0.0 to 6.0.0 in /backend

[dependabot]

Bumps flask-cors from 4.0.0 to 6.0.0.

Release notes

Sourced from flask-cors's releases.

6.0.0

Breaking

Path specificity ordering has changed to improve specificity. This may break users who expected the previous incorrect ordering.

• [CVE-2024-6839] Sort Paths by Regex Specificity by @​adrianosela in corydolphin/flask-cors#391
• [CVE-2024-6844] Replace use of (urllib) unquote_plus with unquote by @​adrianosela in corydolphin/flask-cors#389

What's Changed

• [CVE-2024-6866] Case Sensitive Request Path Matching by @​adrianosela in corydolphin/flask-cors#390

Full Changelog: corydolphin/flask-cors@5.0.1...6.0.0

5.0.1

What's Changed

This primarily changes packaging to use uv and a new release pipeline, along with some small documentation improvements

• [Docs] Fix links to documentation by @​coren-frankel in corydolphin/flask-cors#369
• Fix minor typos by @​kkirsche in corydolphin/flask-cors#371
• Migrate packaging and environment management to use uv by @​corydolphin in corydolphin/flask-cors#377
• Fix release pipeline by @​corydolphin in corydolphin/flask-cors#378
• Always use trusted publishing by @​corydolphin in corydolphin/flask-cors#379
• Workaround license publishing issue by @​corydolphin in corydolphin/flask-cors#380
• Fix packaging: missing source files by @​corydolphin in corydolphin/flask-cors#381

New Contributors

• @​coren-frankel made their first contribution in corydolphin/flask-cors#369
• @​kkirsche made their first contribution in corydolphin/flask-cors#371

Full Changelog: corydolphin/flask-cors@5.0.0...5.0.01

5.0.0

What's Changed

• Breaking: Change default to disable private network access by @​corydolphin in corydolphin/flask-cors#368 This effectively resolves GHSA-hxwh-jpp2-84pm https://osv.dev/vulnerability/PYSEC-2024-71

Full Changelog: corydolphin/flask-cors@4.0.2...5.0.0

4.0.2

What's Changed

• Bump requests from 2.31.0 to 2.32.0 in /docs by @​dependabot in corydolphin/flask-cors#358
• Backwards Compatible Fix for CVE-2024-6221 by @​adrianosela in corydolphin/flask-cors#363
• Add unit tests for Private-Network by @​corydolphin in corydolphin/flask-cors#367

New Contributors

• @​dependabot made their first contribution in corydolphin/flask-cors#358
• @​adrianosela made their first contribution in corydolphin/flask-cors#363

Full Changelog: corydolphin/flask-cors@4.0.1...4.0.2

... (truncated)

Changelog

Sourced from flask-cors's changelog.

Change Log

4.0.1

Security

• Address CVE-2024-1681 which is a log injection vulnerability when the log level is set to debug by @​aneshujevic in corydolphin/flask-cors#351

Commits

• 35d8753 [CVE-2024-6844] Replace use of (urllib) unquote_plus with unquote for paths (...
• e970988 [CVE-2024-6839] Sort Paths by Regex Specificity (#391)
• eb39516 [CVE-2024-6866] Case Sensitive Request Path Matching (#390)
• 5da9be4 Fix packaging: missing source files (#381)
• 65a5132 Workaround license publishing issue (#380)
• 7127e7e Always use trusted publishing (#379)
• 01e2e68 Fix release pipeline (#378)
• ade65a1 Major Packaging Refactor: migrate to uv (#377)
• eb44bff fix: typos (#371)
• 1225e78 replace documentation links in README (#369)
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Summary by cubic

Upgrade Flask-CORS to 6.0.0 in the backend to pick up security fixes and stricter, case-sensitive path matching. This may change how CORS rules apply to some routes and disables Private Network Access by default.

• Dependencies

  • Flask-CORS 4.0.0 → 6.0.0 (includes CVE fixes and updated path matching)

• Migration

  • Review CORS resource patterns: matching is now case-sensitive and path specificity ordering changed; confirm the intended rule applies per route.
  • If clients require Private Network Access, explicitly enable it in CORS config (private_network=True).
  • Verify preflight behavior for routes with “+” or encoded characters due to URL decoding changes.

^{Written for commit 6ce0bad. Summary will update on new commits.}

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
eidw-times	Ready	Preview, Comment	Feb 9, 2026 0:02am

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

• 🔍 Trigger a full review

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}