From 35b45f2149fd1e0f45a269ab63e7365f41611119 Mon Sep 17 00:00:00 2001
From: "sentry-junior[bot]"
 <264270552+sentry-junior[bot]@users.noreply.github.com>
Date: Wed, 28 Oct 2026 21:43:00 +0000
Subject: [PATCH 1/2] build(backend-py): Upgrade to Flask 3 and Werkzeug 3

Upgrade Flask 2.0.3 -> 3.1.3, Werkzeug 2.0.3 -> 3.1.9 and Flask-Cors
3.0.10 -> 6.0.5, along with the pins Flask 3 requires (click,
itsdangerous, MarkupSafe, and the new blinker dependency).

Remove Flask-SQLAlchemy, which is not imported anywhere and whose
pinned 2.5.1 release does not support Flask 3. Bump black to 22.6.0
(the version pre-commit already uses) because black 22.1.0 fails to
start with click 8.1+.

Flask 2.3 stopped reading FLASK_ENV, so the dev server no longer
enables the reloader from .env. Pass --reload in the Dockerfile so
the bind-mounted src/ still reloads on change; debug mode stays off.

Refs IE-93

Co-Authored-By: Matt Duncan <matt.duncan@sentry.io>
---
 backend-py/Dockerfile       |  2 +-
 backend-py/requirements.txt | 16 ++++++++--------
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/backend-py/Dockerfile b/backend-py/Dockerfile
index cd3d1a9..0faa1a1 100644
--- a/backend-py/Dockerfile
+++ b/backend-py/Dockerfile
@@ -11,4 +11,4 @@ RUN pip install -r requirements.txt
 # Copy the rest of the source code now, otherwise, code changes will invalidate the requirements cache
 COPY . .
 # Preparing startup...
-CMD ["flask", "run"]
+CMD ["flask", "run", "--reload"]
diff --git a/backend-py/requirements.txt b/backend-py/requirements.txt
index d4f2403..aa7ff64 100644
--- a/backend-py/requirements.txt
+++ b/backend-py/requirements.txt
@@ -1,18 +1,18 @@
 attrs==21.4.0
-black==22.1.0
+black==22.6.0
+blinker==1.9.0
 certifi==2026.10.23
 charset-normalizer==2.0.12
-click==8.0.4
+click==8.5.0
 flake8==4.0.1
-Flask==2.0.3
-Flask-Cors==3.0.10
-Flask-SQLAlchemy==2.5.1
+Flask==3.1.3
+Flask-Cors==6.0.5
 greenlet==3.5.6
 idna==3.20
 iniconfig==1.1.1
-itsdangerous==2.1.0
+itsdangerous==2.2.0
 Jinja2==3.1.6
-MarkupSafe==2.1.0
+MarkupSafe==3.0.4
 mccabe==0.6.1
 mypy-extensions==0.4.3
 packaging==21.3
@@ -33,4 +33,4 @@ SQLAlchemy==1.4.32
 tomli==2.0.1
 typing_extensions==4.1.1
 urllib3==2.8.0
-Werkzeug==2.0.3
+Werkzeug==3.1.9

From fecffe4ed17a5c3fb2ea78938a7193795a9ae1e2 Mon Sep 17 00:00:00 2001
From: "sentry-junior[bot]"
 <264270552+sentry-junior[bot]@users.noreply.github.com>
Date: Wed, 28 Oct 2026 21:46:42 +0000
Subject: [PATCH 2/2] build(backend-py): Drop black from requirements.txt

Every black release before 26.10.1 is covered by GHSA-cg8m-r9f2-5wm2
(high), which fails dependency-review when the pin changes. Black is
not imported by the app and CI runs it through pre-commit, which
installs its own pinned copy, so remove it along with the pins only it
needed (mypy-extensions, pathspec, platformdirs).

Refs IE-93
---
 backend-py/requirements.txt | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/backend-py/requirements.txt b/backend-py/requirements.txt
index aa7ff64..c096081 100644
--- a/backend-py/requirements.txt
+++ b/backend-py/requirements.txt
@@ -1,5 +1,4 @@
 attrs==21.4.0
-black==22.6.0
 blinker==1.9.0
 certifi==2026.10.23
 charset-normalizer==2.0.12
@@ -14,10 +13,7 @@ itsdangerous==2.2.0
 Jinja2==3.1.6
 MarkupSafe==3.0.4
 mccabe==0.6.1
-mypy-extensions==0.4.3
 packaging==21.3
-pathspec==0.9.0
-platformdirs==2.5.1
 pluggy==1.0.0
 psycopg2==2.9.13
 py==1.11.0