Security sweep: bump starlette to 1.3.1 + 6 more vulnerable deps, migrate TemplateResponse API

[thekoma]

Summary

Clears the remaining open Dependabot alerts by bumping every flagged package to (or past) its first patched version:

Package	From	To	Alerts fixed
starlette	0.52.1	1.3.1	GHSA-82w8-qh3p-5jfq (high), GHSA-wqp7-x3pw-xc5r (high), GHSA-x746-7m8f-x49c, GHSA-86qp-5c8j-p5mr, GHSA-jp82-jpqv-5vv3
joserfc	1.6.4	1.7.3	GHSA-gg9x-qcx2-xmrh (high), GHSA-wphv-vfrh-23q5
cryptography	46.0.7	49.0.0	GHSA-537c-gmf6-5ccf (high)
pyjwt	2.12.1	2.13.0	GHSA-xgmm-8j9v-c9wx (high) + 4 more
pydantic-settings	2.13.1	2.14.2	GHSA-4xgf-cpjx-pc3j
Mako	1.3.10	1.3.12	GHSA-2h4p-vjrc-8xpq (high), GHSA-v92g-xgxw-vvmm (high)
Pygments	2.19.2	2.20.0	GHSA-5239-wwwm-4pmq

All packages are transitive deps with open-ended constraints, so only poetry.lock changes.

Starlette 1.x migration

Starlette 1.0 removed the long-deprecated TemplateResponse(name, context) signature — the context dict was being parsed as the template name, which is what broke 31 tests on Dependabot's #233 (TypeError: cannot use 'tuple' as a dict key). All 22 call sites in src/routes/{auth,profile,admin,web}.py now use the TemplateResponse(request, name, context) signature, with the redundant "request" context key removed.

Supersedes #233 (which bumped starlette only to 1.0.1 — still vulnerable to GHSA-82w8-qh3p-5jfq and GHSA-wqp7-x3pw-xc5r, and without the code migration).

Testing

Full suite green locally: 136 passed.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Improved page rendering across administration, authentication, profile, and podcast views.
  • Preserved existing page content, error handling, and authentication flows while ensuring requests are handled consistently during rendering.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b3fd6aab-8390-492d-92f5-a9216a775a78

📥 Commits

Reviewing files that changed from the base of the PR and between e0015fd and 2e0f889.

⛔ Files ignored due to path filters (1)

• poetry.lock is excluded by !**/*.lock

📒 Files selected for processing (4)

• src/routes/admin.py
• src/routes/auth.py
• src/routes/profile.py
• src/routes/web.py

---

📝 Walkthrough

Walkthrough

Route template responses were updated across authentication, admin, profile, and podcast handlers to pass request as the first TemplateResponse argument while preserving existing templates and context values.

Changes

Template rendering updates

Layer / File(s)	Summary
Authentication template rendering src/routes/auth.py	Setup, login, password-change, forgot-password, and reset-password responses now use request-first TemplateResponse calls across success and error branches.
Admin, profile, and podcast rendering src/routes/admin.py, src/routes/profile.py, src/routes/web.py	Admin, profile, podcast directory, and podcast episode responses now pass request positionally without changing template context data.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the dependency security sweep and the TemplateResponse API migration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch security/deps-sweep

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}