From 5918cdf8398132c932b7163f55afc99e4f765d29 Mon Sep 17 00:00:00 2001
From: 9qeklajc <tthefux@gmail.com>
Date: Wed, 9 Sep 2026 22:19:04 +0200
Subject: [PATCH] clean up

---
 pyproject.toml | 27 ++++++++++++---------------
 uv.lock        | 11 +++++++----
 2 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index 5cbef9b0..38f1ac94 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -88,24 +88,21 @@ disallow_untyped_decorators = true
 [tool.uv.sources]
 routstr = { workspace = true }
 
-# Security overrides (2026-09): cashu 0.20.x pins conservative upper bounds
-# (h11<0.15, fastapi<0.116, cryptography<44, setuptools<76, wheel<0.42) that
-# conflict with the patched versions of these libraries. routstr only imports
-# cashu's wallet-side modules, which never exercise the fastapi/starlette/h11
-# server paths those caps were set for.
+# Security floors. cashu 0.20.x caps h11, fastapi, cryptography, setuptools
+# and wheel below their patched versions. routstr uses only cashu's wallet
+# modules, not its server paths, so the caps are safe to lift here.
 [tool.uv]
 override-dependencies = [
-    "h11>=0.16.0",                 # CVE-2025-43859: chunked-encoding smuggling (critical)
-    "fastapi[standard-no-fastapi-cloud-cli]>=0.141",  # gateway to the starlette>=1.3.1 line (cashu caps <0.116)
-    "cryptography>=49.0.0",        # GHSA-jwv3-5hgf-82ww et al. (cashu caps <44)
-    "setuptools>=83.0.0",          # CVE-2026-59890, CVE-2025-47273 (cashu caps <76)
-    "wheel>=0.46.2",               # CVE-2026-24049 (cashu caps <0.42)
+    "h11>=0.16.0",
+    "fastapi[standard-no-fastapi-cloud-cli]>=0.141",
+    "cryptography>=49.0.0",
+    "setuptools>=83.0.0",
+    "wheel>=0.46.2",
 ]
 
-# Floors for transitive deps whose locked versions are still in-range for their
-# dependents but below the patched versions. Constraints (unlike overrides)
-# don't bypass any upstream pin — they only force the resolver to take the
-# fixed versions.
+# Transitive deps whose dependents allow the patched version but don't require
+# it. Constraints raise the floor without bypassing any upstream pin.
 constraint-dependencies = [
-    "starlette>=1.3.1",            # CVE-2026-54283, CVE-2026-48818, CVE-2026-48817, CVE-2026-48710, CVE-2025-62727, CVE-2025-54121
+    "starlette>=1.3.1",
+    "httpcore>=1.0.9",             # 1.0.8 caps h11<0.15
 ]
diff --git a/uv.lock b/uv.lock
index ac3db938..18e9d483 100644
--- a/uv.lock
+++ b/uv.lock
@@ -8,7 +8,10 @@ resolution-markers = [
 ]
 
 [manifest]
-constraints = [{ name = "starlette", specifier = ">=1.3.1" }]
+constraints = [
+    { name = "httpcore", specifier = ">=1.0.9" },
+    { name = "starlette", specifier = ">=1.3.1" },
+]
 overrides = [
     { name = "cryptography", specifier = ">=49.0.0" },
     { name = "fastapi", extras = ["standard-no-fastapi-cloud-cli"], specifier = ">=0.141" },
@@ -1296,15 +1299,15 @@ wheels = [
 
 [[package]]
 name = "httpcore"
-version = "1.0.8"
+version = "1.0.9"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "certifi" },
     { name = "h11" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/9f/45/ad3e1b4d448f22c0cff4f5692f5ed0666658578e358b8d58a19846048059/httpcore-1.0.8.tar.gz", hash = "sha256:86e94505ed24ea06514883fd44d2bc02d90e77e7979c8eb71b90f41d364a1bad", size = 85385, upload-time = "2025-04-11T14:42:46.661Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/06/94/82699a10bca87a5556c9c59b5963f2d039dbd239f25bc2a63907a05a14cb/httpcore-1.0.9.tar.gz", hash = "sha256:6e34463af53fd2ab5d807f399a9b45ea31c3dfa2276f15a2c3f00afff6e176e8", size = 85484, upload-time = "2025-04-24T22:06:22.219Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/18/8d/f052b1e336bb2c1fc7ed1aaed898aa570c0b61a09707b108979d9fc6e308/httpcore-1.0.8-py3-none-any.whl", hash = "sha256:5254cf149bcb5f75e9d1b2b9f729ea4a4b883d1ad7379fc632b727cec23674be", size = 78732, upload-time = "2025-04-11T14:42:44.896Z" },
+    { url = "https://files.pythonhosted.org/packages/7e/f5/f66802a942d491edb555dd61e3a9961140fd64c90bce1eafd741609d334d/httpcore-1.0.9-py3-none-any.whl", hash = "sha256:2d400746a40668fc9dec9810239072b40b4484b640a8c38fd654a024c7a1bf55", size = 78784, upload-time = "2025-04-24T22:06:20.566Z" },
 ]
 
 [[package]]