Release 2026-07-17 (#906)

* added the metering code

* added logging

* added the sap metering sidecar

* updated the auth token usage

* updated the comments

* updated the env vars

* fix: update cryptography to 46.0.7 to address CVE-2026-39892

- Updated cryptography from 46.0.5 to 46.0.7
- Fixes buffer overflow vulnerability in non-contiguous buffer handling
- Regenerated requirements.txt with Python 3.10
- All unit tests passing (184 passed)
- All linting checks passing

* Bumped the cryptography module version to latest 47.0.0

* Fix CVE-2026-25645 and CVE-2026-34073 by upgrading requests and cryptography

Updated requests from 2.32.5 to 2.33.1 to address CVE-2026-25645.
Updated cryptography from 46.0.5 to 47.0.0 to address CVE-2026-34073.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* Security/upgrade requests urllib3 CVE fix (#894)

* Security: Upgrade requests to 2.34.2 and urllib3 to 2.7.0

Fixes high-severity CVEs:
- CVE-2026-25645 (requests): Fixed in 2.33.0+
- GHSA-mf9v-mfxr-j63j (urllib3): Streaming API decompression issue
- GHSA-qccp-gfcp-xxvc (urllib3): Cross-origin redirect header leakage

Changes:
- requests: 2.32.5 → 2.34.2
- urllib3: 2.6.3 → 2.7.0
- charset-normalizer: 2.0.3 → 3.4.7 (transitive)
- idna: 3.10 → 3.15 (transitive)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* Fixes high-severity CVEs:
   - CVE-2026-25645 (requests): Fixed in 2.33.0+
   - GHSA-mf9v-mfxr-j63j (urllib3): Streaming API decompression issue
   - GHSA-qccp-gfcp-xxvc (urllib3): Cross-origin redirect header leakage

---------

Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>

* (fix) add typing extension lib (#898)

* Update requirements.txt

* Update requirements.in

* Expand static files caching (#901)

Support static files caching

* Security: Fix CVE-2026-45409 (idna) and GHSA-537c-gmf6-5ccf (cryptogr… (#902)

Security: Fix CVE-2026-45409 (idna) and GHSA-537c-gmf6-5ccf (cryptography)

Upgrades dependencies to address high-severity vulnerabilities:
- cryptography 47.0.0 → 48.0.1: Fixes vulnerable OpenSSL in wheels
- idna 3.10 → 3.15: Fixes DoS vulnerability in IDNA encoding

CVE-2026-45409: idna versions prior to 3.15 were vulnerable to DoS
attacks via specially crafted inputs to idna.encode() function.

GHSA-537c-gmf6-5ccf: cryptography wheels prior to 48.0.1 included
a statically linked copy of OpenSSL with security vulnerabilities.

---------

Co-authored-by: bhavin.shah <bhavin.shah@mendix.com>
Co-authored-by: priyal.chawda@mendix.com <priyal.chawda@mendix.com>
Co-authored-by: Piyush <piyush.tiwari@mendix.com>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
Co-authored-by: Bhavin Shah <162097397+bhavinshah-mendix@users.noreply.github.com>
Co-authored-by: Sanny Ramirez <sai.ramirez.umak@gmail.com>
Co-authored-by: EnasAbdelrazek <96430281+EnasAbdelrazek@users.noreply.github.com>

Author: 8 people

etc/nginx/conf/nginx.conf.j2

@@ -97,7 +97,7 @@ http {
         {{ location.body }}
         }
         {% else %}
-            if ($request_uri ~ ^/(.*\.(css|js)|forms/.*|img/.*|pages/.*|mxclientsystem/images/.*)\?[0-9]+$) {
+            if ($request_uri ~ ^/((.*\.(css|js)|forms/.*|img/.*|pages/.*|mxclientsystem/images/.*)\?[0-9]+|dist/chunks/.*\.js|.*\.(woff2?|ttf|otf|eot))$) {
                     expires 1y;
             }
         {% if location.path == "/" %}

requirements-dev.in

@@ -1,5 +1,5 @@
 click==8.1.7
-idna==3.10
+idna==3.15
 pytest==8.3.3
 pytest-timer==1.0.0
 pytest-timeout==2.3.1

requirements.in

@@ -1,8 +1,9 @@
 backoff==2.2.1
 certifi==2024.8.30
-cryptography==47.0.0
+cryptography==48.0.1
 distro==1.9.0
 httplib2==0.22.0
+idna==3.15
 jinja2==3.1.6
 omegaconf==2.3.0
 psycopg2-binary==2.9.10

requirements.txt

@@ -16,14 +16,16 @@ cffi==2.0.0
     # via cryptography
 charset-normalizer==2.0.3
     # via requests
-cryptography==47.0.0
+cryptography==48.0.1
     # via -r requirements.in
 distro==1.9.0
     # via -r requirements.in
 httplib2==0.22.0
     # via -r requirements.in
-idna==3.10
-    # via requests
+idna==3.15
+    # via
+    #   -r requirements.in
+    #   requests
 jinja2==3.1.6
     # via -r requirements.in
 markupsafe==2.0.1