fix(deps): update all patch dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
Werkzeug (changelog)	3.1.6 → 3.1.8
fido2	2.2.0 → 2.2.1
jsonwebtoken	9.0.2 → 9.0.3
mailparser	3.9.3 → 3.9.14
psycopg2-binary (source, changelog)	2.9.11 → 2.9.12
psycopg2-binary (source, changelog)	==2.9.11 → ==2.9.12
simple-salesforce (changelog)	1.12.9 → 1.12.10
types-python-dateutil (changelog)	2.9.0.20251115 → 2.9.0.20260518

Review

• Updates have been tested and work
• If updates are AWS related, versions match the infrastructure (e.g. Lambda runtime, database, etc.)

---

Release Notes

pallets/werkzeug (Werkzeug)

v3.1.8

Compare Source

Released 2026-04-02

• Request.host and get_host return the empty string if the header is
  missing or has invalid characters. :issue:3142

v3.1.7

Compare Source

Released 2026-03-23

• parse_list_header preserves partially quoted items, discards empty
  items, and returns empty for unclosed quoted values. :pr:3128
• WWWAuthenticate.to_header does not produce a trailing space when there
  are no parameters. :issue:3127
• Transfer-Encoding is parsed as a set. :pr:3134
• Request.host, get_host, and host_is_trusted validate the
  characters of the value. An empty value is no longer allowed. A Unix socket
  server address is ignored. The trusted_list argument to
  host_is_trusted is optional. :pr:3113
• Fix multipart form parser handling of newline at boundary. :issue:3088
• Response.make_conditional sets the Accept-Ranges header even if it
  is not a satisfiable range request. :issue:3108
• merge_slashes merges any number of consecutive slashes. :issue:3121

Yubico/python-fido2 (fido2)

v2.2.1: python-fido2 2.2.1

Compare Source

Version 2.2.1 (released 2026-06-29)

• Server example: Migrate build tool from poetry to uv.
• Fix: Correctly format att_obj in previewSign.

auth0/node-jsonwebtoken (jsonwebtoken)

v9.0.3

Compare Source

• updates jws version to 4.0.1.

nodemailer/mailparser (mailparser)

v3.9.14

Compare Source

Bug Fixes

• update dependencies (@​zone-eu/mailsplit 5.4.14) (595b150)

v3.9.13

Compare Source

Bug Fixes

• update dependencies (nodemailer 9.0.3, iconv-lite 0.7.3, libmime 5.4.1) (999e77b)

v3.9.12

Compare Source

Bug Fixes

• decode iso-8859-8-i and iso-8859-8-e charsets as iso-8859-8 (3e4b7fc)

v3.9.11

Compare Source

Bug Fixes

• bump nodemailer to 9.0.1 (020f140)

v3.9.10

Compare Source

Bug Fixes

• bump dependencies (nodemailer 9, eslint 10.5, prettier 3.8.4) (262ecff)

v3.9.9

Compare Source

Bug Fixes

• bumped deps (7a83b91)

v3.9.8

Compare Source

Bug Fixes

• Bumped deps (ea415b2)

v3.9.7

Compare Source

Bug Fixes

• Bumped deps (35cf54f)

v3.9.6

Compare Source

Bug Fixes

• bump nodemailer to 8.0.4 (b2d7f77)

v3.9.5

Compare Source

Bug Fixes

• Bumped deps (1556b84)

v3.9.4

Compare Source

Bug Fixes

• bump nodemailer to 8.0.2 for unquoted comma-in-display-name parsing (dd71f08)
• filter false values from empty References headers (9884e5d), closes #​385
• prevent RFC 2047 encoded-word address fabrication in decodeAddresses (08b800c)

psycopg/psycopg2 (psycopg2-binary)

v2.9.12

Compare Source

simple-salesforce/simple-salesforce (simple-salesforce)

v1.12.10

Compare Source

========
Features

• [#​825] Add Python 3.14 support

Bug fixes

• [#​825] Fix SalesforceAuthenticationFailed raising TypeError when the
  Salesforce error response has no error_description

Other

• [#​824] Publish to PyPI via GitHub Actions trusted publishing
• [#​825] Fix CI so the tox test envs actually run the test suite

---

Configuration

📅 Schedule: (in timezone America/Montreal)

• Branch creation
  • "every weekend"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: poetry.lock

Updating dependencies
Resolving dependencies...


Because notifications-utils (53.2.29) @ git+https://github.com/cds-snc/notifier-utils.git@53.2.29 depends on both werkzeug (3.1.6) and werkzeug (3.1.6), werkzeug is required.
So, because notification-api depends on Werkzeug (3.1.8), version solving failed.