[Serph91P]

Summary

Closes #1046. Required by the final verification of #950 / PR #981; this is not a broad dependency batch or a backend feature change.

• Patch only the pinned oauthlib 4.0.0 -> 4.0.1, the official fix for GHSA-3jp2-3mrg-2vxc / CVE-2026-49272. Regenerate uv.lock and the existing requirements export using native uv commands.
• Add the patched floor to the existing offline security-dependency regression; preserve the existing JWT/OAuth-client compatibility checks.
• No other locked package/version, product code, workflow, scanner policy, skip, timeout or budget changes. Existing refactor(backend): complete production-grade modernization and operational gates #842 modernization work and grouped Dependabot PR1039 remain untouched.

Evidence and reason

After PR981's successful exact-head checks and authorized regular merge 9e5d4e1c, the unchanged postmerge pip-audit/Quick Security gates reported this newly current advisory on oauthlib4.0.0: Security, Tests. Earlier exact-head reports genuinely had zero Python findings; they do not supersede the current failure. #950 remains open until final current develop acceptance.

Official 4.0.1 release and advisory checked; advisory updated 2026-11-05T20:58:34Z. Device-code validators must implement the new validation hook when serving that grant; this repository uses the OAuth client and does not implement a device-code token server.

• Actual local floor regression: 4.0.0 RED (1 failed / 1 passed) -> frozen 4.0.1 GREEN (2 passed), no network/provider call by these tests.
• Actual current pip-audit on the native locked requirements: 75 dependencies / 0 skipped / 0 vulnerabilities. No ignore IDs or alternate scanner policy.
• Lock comparison parsed all 118 packages: only oauthlib's version/artifacts and the project's direct oauthlib requirement changed; requirements content matches the native export (generated command header compared separately).
• 23/23 exact-head checks SUCCESS, including all 7 required GitHub Actions App15368 contexts. Original full Tests run42124362465, attempt2, Security42124362485 and Docker PR build42124362424 read. All tests, scanner policies, budgets, skips and job timeouts are unchanged. Attempt1 hit a slow Azure APT download before any browser assertion; native unchanged retry passed, not a test waiver. One gh run watch HTTP503 interruption was verified as transport-only and reconnected.
• Fresh local full backend 1092 passed /20 existing skips /2 subtests, Ruff/190-format-files/Mypy5modules passed; actual Python3.14.4 locked backend/SQLite/3MP4/share2/download2/delete2/fileeffects/SVG-MIME/SW-offline journey repeated successfully on this exact correction with oauthlib4.0.1.
• Current CI: 688 units/49 foundation, unchanged REAL/MOCK budgets and both UX06 measurements, 5 REAL player cases,8login,34REAL+34MOCKSettings, 244 main browser passes /46 existing skips, foundation6+1+6. Actual concurrent fresh PostgreSQL: both apps healthy, 48/48 distinct successful migrations, persisted key unchanged after restart, HTTP surface passed.
• Original current Security artifacts: pip 75/0skip/0vuln; npm 18 moderate/2 low/0 high-critical, matching concurrent current-base findings (only glob.fixAvailable suggestion differs); Bandit baseline 0H/2M/66L/1skip. Gitleaks scans the 1-commit/735-byte correction delta with no leaks, not a full-tree clearance; TrivyHC gates pass with existing Alpine EOL-list warning. Existing Dockerfile alerts remain. No all-security-clean claim.

Base develop 9e5d4e1c5a9f493ce1e76fc343931890afef735c, head 651c1cdd243672d53d8268628ed6b59a8129ace5, tree 7f580954d5001e78154cb7f1d9a594217fc95e62; CI-mergetree checked against the exact candidate before merge. Regularly merged as 486899b; expected parents/tree/live develop read back. Final postmerge 22/22 checks SUCCESS and the three original target pipelines all completed/success: Tests42128314090, Security42128314099, existing develop automation42128314084 attempt2. Original logs and Security artifacts match corrected-head evidence; automation's first SARIF upload interruption was retried natively on the same push event, unchanged. #1046 and #950 CLOSED/COMPLETED, criteria checked/status labels removed/exact readbacks verified. Final owner acceptance.

No manual release or deployment. Existing develop branch automation is unchanged.