From 224e48777b4066893d8b1bc1a1b0e01642fa9900 Mon Sep 17 00:00:00 2001
From: Cory Bullinger <cory.bullinger@mongodb.com>
Date: Fri, 23 Jan 2026 12:39:08 -0500
Subject: [PATCH] Bump ojson to 3.11.5

---
 mflix/server/python-fastapi/requirements.in  | 1 +
 mflix/server/python-fastapi/requirements.txt | 6 ++++--
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/mflix/server/python-fastapi/requirements.in b/mflix/server/python-fastapi/requirements.in
index 486ae30..09ec646 100644
--- a/mflix/server/python-fastapi/requirements.in
+++ b/mflix/server/python-fastapi/requirements.in
@@ -63,3 +63,4 @@ rich-toolkit~=0.15.0    # Extensions for the 'rich' library
 # ------------------------------------------------------------------------------
 filelock>=3.20.3        # Transitive dep via huggingface-hub
 aiohttp>=3.13.3         # Transitive dep via voyageai
+orjson>=3.11.5          # Transitive dep via langsmith (CVE fix)
diff --git a/mflix/server/python-fastapi/requirements.txt b/mflix/server/python-fastapi/requirements.txt
index 996a67e..4b92831 100644
--- a/mflix/server/python-fastapi/requirements.txt
+++ b/mflix/server/python-fastapi/requirements.txt
@@ -111,8 +111,10 @@ multidict==6.7.0
     #   yarl
 numpy==2.3.4
     # via voyageai
-orjson==3.11.4
-    # via langsmith
+orjson==3.11.5
+    # via
+    #   -r requirements.in
+    #   langsmith
 packaging==25.0
     # via
     #   huggingface-hub