Relax all pins using compatible version operator and re-freeze

.github/workflows/dependency-review.yaml

@@ -0,0 +1,14 @@
+name: 'Dependency Review'
+on: [pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+     - name: 'Checkout Repository'
+       uses: actions/checkout@v5
+     - name: Dependency Review
+       uses: actions/dependency-review-action@v4

Makefile

@@ -67,12 +67,16 @@ test-with-docker: ## Run tests in Docker container
 fix-imports: ## Fix imports using ruff
 	ruff --fix --select=I .
 
+.PHONY: refreeze-requirements
+refreeze-requirements: ## Update unpinned requirements
+	EXTRA_UV_PIP_COMPILE_FLAGS="--upgrade --exclude-newer 30d" make freeze-requirements
+
 .PHONY: freeze-requirements
 freeze-requirements: ## create static requirements.txt
-	uv pip compile requirements.in -o requirements.txt
+	uv pip compile requirements.in -o requirements.txt $(EXTRA_UV_PIP_COMPILE_FLAGS)
 	uv pip sync requirements.txt
 	python -c "from notifications_utils.version_tools import copy_config; copy_config()"
-	uv pip compile requirements_for_test.in -o requirements_for_test.txt
+	uv pip compile requirements_for_test.in -o requirements_for_test.txt $(EXTRA_UV_PIP_COMPILE_FLAGS)
 	uv pip sync requirements_for_test.txt
 
 .PHONY: bump-utils

requirements.in

@@ -1,20 +1,20 @@
 # Run `make freeze-requirements` to update requirements.txt
 # with package version changes made in requirements.in
 
-ago==0.0.95
-humanize==4.4.0
-Flask-WTF==1.2.1
-Flask-Login==0.6.3
+ago~=0.1
+humanize~=4.4
+Flask-WTF~=1.2
+Flask-Login~=0.6
 
 Pillow~=12.1
 
-pyexcel==0.7.4
-pyexcel-io==0.6.7
-pyexcel-xls==0.7.1
-pyexcel-odsr==0.6.0
+pyexcel~=0.7
+pyexcel-io~=0.6
+pyexcel-xls~=0.7
+pyexcel-odsr~=0.6
 openpyxl~=3.1
 notifications-python-client==10.0.0
-fido2==1.1.3
+fido2~=1.1
 
 # Run `make bump-utils` to update to the latest version
 notifications-utils @ git+https://github.com/alphagov/notifications-utils.git@110.0.0
@@ -23,4 +23,4 @@ govuk-frontend-jinja==3.6.0
 
 git+https://github.com/alphagov/gds_metrics_python.git@6f1840a57b6fb1ee40b7e84f2f18ec229de8aa72
 
-sentry-sdk[flask]==1.45.1
+sentry-sdk[flask]~=1.45

requirements.txt

@@ -1,6 +1,6 @@
 # This file was autogenerated by uv via the following command:
-#    uv pip compile requirements.in -o requirements.txt
-ago==0.0.95
+#    uv pip compile requirements.in -o requirements.txt --exclude-newer 7d
+ago==0.1.0
     # via -r requirements.in
 awscrt==0.31.2
     # via botocore
@@ -9,15 +9,15 @@ blinker==1.9.0
     #   flask
     #   gds-metrics
     #   sentry-sdk
-boto3==1.42.55
+boto3==1.42.59
     # via notifications-utils
-botocore==1.42.55
+botocore==1.42.59
     # via
     #   boto3
     #   s3transfer
 cachetools==7.0.1
     # via notifications-utils
-certifi==2026.1.4
+certifi==2026.2.25
     # via
     #   requests
     #   sentry-sdk
@@ -37,7 +37,7 @@ et-xmlfile==2.0.0
     # via openpyxl
 eventlet==0.40.4
     # via gunicorn
-fido2==1.1.3
+fido2==1.2.0
     # via -r requirements.in
 flask==3.1.3
     # via
@@ -51,19 +51,19 @@ flask-login==0.6.3
     # via -r requirements.in
 flask-redis==0.4.0
     # via notifications-utils
-flask-wtf==1.2.1
+flask-wtf==1.2.2
     # via -r requirements.in
 gds-metrics @ git+https://github.com/alphagov/gds_metrics_python.git@6f1840a57b6fb1ee40b7e84f2f18ec229de8aa72
     # via -r requirements.in
-govuk-bank-holidays==0.18
+govuk-bank-holidays==0.19
     # via notifications-utils
 govuk-frontend-jinja==3.6.0
     # via -r requirements.in
 greenlet==3.3.2
     # via eventlet
 gunicorn==25.1.0
     # via notifications-utils
-humanize==4.4.0
+humanize==4.15.0
     # via -r requirements.in
 idna==3.11
     # via requests
@@ -106,7 +106,7 @@ ordered-set==4.1.0
     # via notifications-utils
 packaging==26.0
     # via gunicorn
-phonenumbers==9.0.24
+phonenumbers==9.0.25
     # via notifications-utils
 pillow==12.1.1
     # via -r requirements.in
@@ -128,7 +128,7 @@ pyexcel-xls==0.7.1
     # via -r requirements.in
 pyjwt==2.11.0
     # via notifications-python-client
-pypdf==6.7.2
+pypdf==6.7.5
     # via notifications-utils
 python-dateutil==2.9.0.post0
     # via
@@ -138,7 +138,7 @@ python-json-logger==4.0.0
     # via notifications-utils
 pyyaml==6.0.3
     # via notifications-utils
-redis==7.2.0
+redis==7.2.1
     # via flask-redis
 requests==2.32.5
     # via

requirements_for_test.in

@@ -1,5 +1,5 @@
 -r requirements.txt
 -r requirements_for_test_common.in
 
-moto==5.1.0
-html5lib==1.1
+moto~=5.1
+html5lib~=1.1

requirements_for_test.txt

@@ -1,6 +1,6 @@
 # This file was autogenerated by uv via the following command:
-#    uv pip compile requirements_for_test.in -o requirements_for_test.txt
-ago==0.0.95
+#    uv pip compile requirements_for_test.in -o requirements_for_test.txt --exclude-newer 7d
+ago==0.1.0
     # via -r requirements.txt
 awscrt==0.31.2
     # via
@@ -13,12 +13,12 @@ blinker==1.9.0
     #   -r requirements.txt
     #   flask
     #   gds-metrics
-boto3==1.42.55
+boto3==1.42.59
     # via
     #   -r requirements.txt
     #   moto
     #   notifications-utils
-botocore==1.42.55
+botocore==1.42.59
     # via
     #   -r requirements.txt
     #   boto3
@@ -28,7 +28,7 @@ cachetools==7.0.1
     # via
     #   -r requirements.txt
     #   notifications-utils
-certifi==2026.1.4
+certifi==2026.2.25
     # via
     #   -r requirements.txt
     #   requests
@@ -70,7 +70,7 @@ eventlet==0.40.4
     #   gunicorn
 execnet==2.1.2
     # via pytest-xdist
-fido2==1.1.3
+fido2==1.2.0
     # via -r requirements.txt
 flask==3.1.3
     # via
@@ -86,13 +86,13 @@ flask-redis==0.4.0
     # via
     #   -r requirements.txt
     #   notifications-utils
-flask-wtf==1.2.1
+flask-wtf==1.2.2
     # via -r requirements.txt
 freezegun==1.5.5
     # via -r requirements_for_test_common.in
 gds-metrics @ git+https://github.com/alphagov/gds_metrics_python.git@6f1840a57b6fb1ee40b7e84f2f18ec229de8aa72
     # via -r requirements.txt
-govuk-bank-holidays==0.18
+govuk-bank-holidays==0.19
     # via
     #   -r requirements.txt
     #   notifications-utils
@@ -108,7 +108,7 @@ gunicorn==25.1.0
     #   notifications-utils
 html5lib==1.1
     # via -r requirements_for_test.in
-humanize==4.4.0
+humanize==4.15.0
     # via -r requirements.txt
 idna==3.11
     # via
@@ -154,7 +154,7 @@ mistune==0.8.4
     # via
     #   -r requirements.txt
     #   notifications-utils
-moto==5.1.0
+moto==5.1.21
     # via -r requirements_for_test.in
 notifications-python-client==10.0.0
     # via -r requirements.txt
@@ -171,7 +171,7 @@ packaging==26.0
     #   -r requirements.txt
     #   gunicorn
     #   pytest
-phonenumbers==9.0.24
+phonenumbers==9.0.25
     # via
     #   -r requirements.txt
     #   notifications-utils
@@ -205,7 +205,7 @@ pyjwt==2.11.0
     # via
     #   -r requirements.txt
     #   notifications-python-client
-pypdf==6.7.2
+pypdf==6.7.5
     # via
     #   -r requirements.txt
     #   notifications-utils
@@ -231,7 +231,7 @@ python-dateutil==2.9.0.post0
     #   freezegun
     #   moto
     #   notifications-utils
-python-dotenv==1.2.1
+python-dotenv==1.2.2
     # via pytest-env
 python-json-logger==4.0.0
     # via
@@ -242,7 +242,7 @@ pyyaml==6.0.3
     #   -r requirements.txt
     #   notifications-utils
     #   responses
-redis==7.2.0
+redis==7.2.1
     # via
     #   -r requirements.txt
     #   flask-redis

tests/app/main/views/test_dashboard.py

@@ -554,7 +554,7 @@ def test_returned_letters_shows_count_of_recently_returned_letters(
         ("2020-01-26", 1, "1 returned letter latest report 7 days ago"),
         ("2020-01-25", 0, "0 returned letters latest report 8 days ago"),
         ("2020-01-01", 0, "0 returned letters latest report 1 month ago"),
-        ("2019-09-09", 0, "0 returned letters latest report 4 months ago"),
+        ("2019-09-09", 0, "0 returned letters latest report 5 months ago"),
         ("2010-10-10", 0, "0 returned letters latest report 9 years ago"),
     ),
 )

tests/app/main/views/test_your_account.py

@@ -568,7 +568,7 @@ def test_should_show_security_keys_page(
     cred_2_lhs = cred_2.select_one("td.table-field-left-aligned")
 
     assert normalize_spaces(cred_1_lhs.text) == "Test credential Last used 4 years ago"
-    assert normalize_spaces(cred_2_lhs.text) == "Another test credential Never used (registered 1 year, 4 months ago)"
+    assert normalize_spaces(cred_2_lhs.text) == "Another test credential Never used (registered 1 year, 5 months ago)"
     manage_link = cred_1.select_one("td.table-field-right-aligned a")
     assert normalize_spaces(manage_link.text) == "Manage"
     assert manage_link["href"] == url_for(".your_account_manage_security_key", key_id=webauthn_credential["id"])