chore(deps)(deps): update flask-cors requirement from >=4.0.0 to >=6.0.5

[dependabot]

Updates the requirements on flask-cors to permit the latest version.

Release notes

Sourced from flask-cors's releases.

6.0.5

Supersedes 6.0.4

What's Changed

• Add MyPy Typing and modernize options parsing by @​corydolphin in corydolphin/flask-cors#409 (this broke strict type checking when using Blueprints)
• Restore Blueprint support in CORS type signatures (#410) by @​corydolphin in corydolphin/flask-cors#411

Full Changelog: corydolphin/flask-cors@6.0.3...6.0.5

Changelog

Sourced from flask-cors's changelog.

Change Log

Unreleased

• Fix mypy --strict rejecting CORS(blueprint) / init_app(blueprint). The app parameter is now typed as Flask | Blueprint | None, restoring Blueprint support broken in 6.0.4 (#410). A type-checking regression test guards this going forward.
• Add full type annotations and a py.typed marker. The package now passes mypy --strict, checked in CI.
• Type the keyword arguments to CORS, init_app, and cross_origin so invalid options are caught by type checkers.
• Resolve options into a frozen internal dataclass instead of a plain dict.
• Invalid regular expressions now raise instead of being silently ignored.

4.0.1

Security

• Address CVE-2024-1681 which is a log injection vulnerability when the log level is set to debug by @​aneshujevic in corydolphin/flask-cors#351

4.0.0

• Remove support for Python versions older than 3.8 by @​WAKayser in corydolphin/flask-cors#330
• Add GHA tooling by @​corydolphin in corydolphin/flask-cors#331

3.1.01

• Include examples to specify that schema and port must be included in … by @​YPCrumble in corydolphin/flask-cors#294
• two small changes to the documentation, based on issue #290 by @​bbbart in corydolphin/flask-cors#291
• Fix typo by @​sunarch in corydolphin/flask-cors#304
• FIX: typo in CSRF by @​sattamjh in corydolphin/flask-cors#315
• Test against recent Python versions by @​pylipp in corydolphin/flask-cors#314
• Correct spelling mistakes by @​EdwardBetts in corydolphin/flask-cors#311
• 'Access-Control-Allow-Private-Network = true' header for http response by @​chelo-kjml in corydolphin/flask-cors#318
• docs: Fix a few typos by @​timgates42 in corydolphin/flask-cors#323
• [Docs] Fix typo in configuration documentation by @​sachit-shroff in corydolphin/flask-cors#316

3.0.10

Adds support for PPC64 and ARM64 builds for distribution. Thanks @​sreekanth370

3.0.9

Security

• Escape path before evaluating resource rules (thanks to Colby Morgan). Prior to this, flask-cors incorrectly evaluated CORS resource matching before path expansion. E.g. "/api/../foo.txt" would incorrectly match resources for "/api/*" whereas the path actually expands simply to "/foo.txt"

3.0.8

Fixes : DeprecationWarning: Using or importing the ABCs from 'collections' in Python 3.7. Thank you @​juanmaneo and @​jdevera for the contribution.

3.0.7

Updated logging.warn to logging.warning (#234) Thanks Vaibhav

3.0.6

Manual error in release process. Identical contents at 3.0.5.

3.0.5

Fixes incorrect handling of regexes containing [, and a few other special characters. Fixes Issue #212

... (truncated)

Commits

• 91ebc49 Typing Hotfix: support blueprints in the type system
• d601665 Add strict MyPy Typing
• c8e8871 Harden release publishing workflow (#406)
• e1d4034 Derive package version from git tag via setuptools-scm (#405)
• fa55dcb Update license pyproject.toml (#395)
• a5003f3 Fix README file extension in pyproject.toml (#386)
• 4ad56d6 Fix regex sorting issue from #391 (#392)
• 35d8753 [CVE-2024-6844] Replace use of (urllib) unquote_plus with unquote for paths (...
• e970988 [CVE-2024-6839] Sort Paths by Regex Specificity (#391)
• eb39516 [CVE-2024-6866] Case Sensitive Request Path Matching (#390)
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
learn-sphere-2-zjk8	Ready	Preview	Aug 4, 2026 4:45am

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.