From ea24d97c9e3d726d6d47502758f37548f9acb09e Mon Sep 17 00:00:00 2001
From: James <james.bradley7@nhs.net>
Date: Tue, 10 Feb 2026 14:29:21 +0000
Subject: [PATCH 1/4] mesh-2092: add make update to workflow

---
 .github/workflows/dependabot-auto-merge.yaml | 35 ++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/.github/workflows/dependabot-auto-merge.yaml b/.github/workflows/dependabot-auto-merge.yaml
index 95f57ed..e9b57ae 100644
--- a/.github/workflows/dependabot-auto-merge.yaml
+++ b/.github/workflows/dependabot-auto-merge.yaml
@@ -10,8 +10,43 @@ on:
       - labeled
 
 jobs:
+  export-requirements:
+    # if: github.actor == 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.head_ref }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install Poetry
+        run: |
+          curl -sSL https://install.python-poetry.org | python3 -
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
+
+      - name: Export requirements
+        run: make export-requirements
+
+      - name: Commit and push changes
+        run: |
+          git config --global user.name 'github-actions[bot]'
+          git config --global user.email 'github-actions[bot]@users.noreply.github.com'
+          git add requirements.txt
+          git diff --staged --quiet || git commit -m "mesh-2092: update requirements.txt"
+          git push
+
   enable-automerge:
     # Only run on Dependabot PRs
+    needs: export-requirements
     if: github.actor == 'dependabot[bot]'
     runs-on: ubuntu-latest
     permissions:

From 0bb42e3019f3edef25c17011fd05abee95dd7f10 Mon Sep 17 00:00:00 2001
From: James <james.bradley7@nhs.net>
Date: Tue, 10 Feb 2026 15:52:58 +0000
Subject: [PATCH 2/4] mesh-2092: update install process

---
 .github/workflows/dependabot-auto-merge.yaml | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/dependabot-auto-merge.yaml b/.github/workflows/dependabot-auto-merge.yaml
index e9b57ae..bb440ad 100644
--- a/.github/workflows/dependabot-auto-merge.yaml
+++ b/.github/workflows/dependabot-auto-merge.yaml
@@ -23,15 +23,20 @@ jobs:
           ref: ${{ github.head_ref }}
           token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Set up Python
-        uses: actions/setup-python@v5
+      - name: setup python
+        uses: actions/setup-python@v6
         with:
-          python-version: '3.11'
+          python-version-file: "pyproject.toml"
 
-      - name: Install Poetry
+      - name: setup poetry
+        uses: abatilo/actions-poetry@0dd19c9498c3dc8728967849d0d2eae428a8a3d8
+        with:
+          poetry-version: 2.1.2
+
+      - name: add poetry plugins
         run: |
-          curl -sSL https://install.python-poetry.org | python3 -
-          echo "$HOME/.local/bin" >> $GITHUB_PATH
+          poetry self add "poetry-dynamic-versioning[plugin]"
+          poetry self add poetry-plugin-export
 
       - name: Export requirements
         run: make export-requirements

From 508197e189e2a56ac8f18bcafe97a84224aa8493 Mon Sep 17 00:00:00 2001
From: James <james.bradley7@nhs.net>
Date: Tue, 10 Feb 2026 16:22:52 +0000
Subject: [PATCH 3/4] mesh-2092: knock a requirement

---
 requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/requirements.txt b/requirements.txt
index 5e2fa3c..b922d3f 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -528,6 +528,6 @@ urllib3==2.6.3 ; python_version >= "3.11" and python_full_version < "3.14.0" \
 uvicorn==0.40.0 ; python_version >= "3.11" and python_full_version < "3.14.0" \
     --hash=sha256:839676675e87e73694518b5574fd0f24c9d97b46bea16df7b8c05ea1a51071ea \
     --hash=sha256:c6c8f55bc8bf13eb6fa9ff87ad62308bbbc33d0b67f84293151efe87e0d5f2ee
-werkzeug==3.1.5 ; python_version >= "3.11" and python_full_version < "3.14.0" \
+werkzeug==4.1.5 ; python_version >= "3.11" and python_full_version < "3.14.0" \
     --hash=sha256:5111e36e91086ece91f93268bb39b4a35c1e6f1feac762c9c822ded0a4e322dc \
     --hash=sha256:6a548b0e88955dd07ccb25539d7d0cc97417ee9e179677d22c7041c8f078ce67

From 117ebb9e7a8b8d62d361cef566a6d1f1f2d3742c Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Tue, 10 Feb 2026 16:23:31 +0000
Subject: [PATCH 4/4] mesh-2092: update requirements.txt

---
 requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/requirements.txt b/requirements.txt
index b922d3f..5e2fa3c 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -528,6 +528,6 @@ urllib3==2.6.3 ; python_version >= "3.11" and python_full_version < "3.14.0" \
 uvicorn==0.40.0 ; python_version >= "3.11" and python_full_version < "3.14.0" \
     --hash=sha256:839676675e87e73694518b5574fd0f24c9d97b46bea16df7b8c05ea1a51071ea \
     --hash=sha256:c6c8f55bc8bf13eb6fa9ff87ad62308bbbc33d0b67f84293151efe87e0d5f2ee
-werkzeug==4.1.5 ; python_version >= "3.11" and python_full_version < "3.14.0" \
+werkzeug==3.1.5 ; python_version >= "3.11" and python_full_version < "3.14.0" \
     --hash=sha256:5111e36e91086ece91f93268bb39b4a35c1e6f1feac762c9c822ded0a4e322dc \
     --hash=sha256:6a548b0e88955dd07ccb25539d7d0cc97417ee9e179677d22c7041c8f078ce67