build(deps): bump authlib from 1.6.9 to 1.6.11 in the uv group across 1 directory

[dependabot]

Bumps the uv group with 1 update in the / directory: authlib.

Updates authlib from 1.6.9 to 1.6.11

Release notes

Sourced from authlib's releases.

v1.6.11

Full Changelog: authlib/authlib@v1.6.10...v1.6.11

• Fix CSRF issue with starlette client

v1.6.10

Full Changelog: authlib/authlib@v1.6.9...v1.6.10

• Fix redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError.

Changelog

Sourced from authlib's changelog.

Version 1.6.11

Released on Apr 16, 2026

• Fix CSRF vulnerability in the Starlette OAuth client when a cache is configured.

Version 1.6.10

Released on Apr 13, 2026

• Fix redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError.

Commits

• 0dc0e5b chore: bump to 1.6.11
• aa7b8e4 Merge commit from fork
• 401a770 fix: CSRF issue with starlette client
• ef09aeb chore: release 1.6.10
• 3be0846 fix: redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError
• See full diff in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[tomkabel]

@dependabot rebase

[kilo-code-bot]

Code Review Roast 🔥

Verdict: No Issues Found | Recommendation: Merge

Oh wait, this PR is actually clean. I need to sit down. I had my flamethrower warmed up and everything.

But let's be real — this isn't just "bump a number in a lockfile and call it a day." Dependabot quietly slipped in two security patches that your production app should not be without:

• v1.6.10: Fixed redirecting to an unvalidated redirect_uri — an open redirect that an attacker could weaponize to phish your users off your own OAuth flow.
• v1.6.11: Fixed a CSRF vulnerability in the Starlette OAuth client when a cache is configured. If your app uses a cached Starlette client, this was a free ticket for attackers to forge state tokens.

These are the kind of dependency bumps that don't need roast-level scrutiny — they need a fast-forward merge and a deploy. The only thing "broken" here would be leaving this PR open any longer.

📊 Overall: Like finding a unicorn in production — a dependabot PR that actually patches real vulns and doesn't break anything. Ship it.

Files Reviewed (1 file)

• uv.lock - Lockfile-only change, generated file (no issues)

---

_{Reviewed by deepseek-v4-pro · 66,547 tokens}