Long overdue maintenance

[mgerni]

Starting to put some more work in on TaskApp. Bringing some packages up to date and adding some long overdue automations.

Changes Overview

• Dependency cleanup: 47 pinned packages down to the 9 we actually import. requirements.txt is now generated with hashes (that's most of the 12k additions), pip-audit comes back clean.
• Code updates the new versions needed:
  • itsdangerous dropped the old token serializer, so password reset / email verify tokens now use URLSafeTimedSerializer.
  • flask_recaptcha is unmaintained and breaks on current Jinja, so it's swapped for a small recaptcha_helper.py. recaptcha.verify() works the same as before.
  • bcrypt 5 throws an error on passwords over 72 bytes instead of quietly cutting them off, so we cut them off ourselves first. Existing passwords still work.
• Small fixes: password reset rejects a bad token on submit, removed an unused template variable and dead markup in base.html.
• pytest: 65 tests covering login, reset, profile, Discord, the API and page loads. No database or network needed. Feel free to add any tests.
• CI on PR creation: runs the tests, checks requirements.txt still matches requirements.in, and runs pip-audit. Also re-audits master every Monday for new CVEs.
• Python 3.14: Heroku's runtime.txt is deprecated, so it's migrated to .python-version. Set to 3.14 so Heroku picks up patch releases on its own.
• Additional .gitignore entries so I can maintain my organized chaos.

Adding a package

Add it to requirements.in (or requirements-dev.in if it's only for tests), then regenerate the matching .txt and commit both files.

pip-tools

pip install pip-tools
pip-compile --generate-hashes requirements.in
pip-compile --generate-hashes requirements-dev.in

uv

uv pip compile requirements.in --generate-hashes -o requirements.txt
uv pip compile requirements-dev.in --generate-hashes -o requirements-dev.txt

To bump a single package without touching the rest, add --upgrade-package <name> to either command.

@rmobis @cringland I'll hold off on merging until later this weekend to give y'all a chance to review in case I borked anything. Mostly updates and some tests AI whipped up; I'm far too lazy to write my own tests.

[rmobis]

LGTM