Update development dependencies to mitigate Snyk-reported vulnerabilities

[owenlittlejohns]

Description

This PR updates the dev.txt file to mitigate a high-severity vulnerability reported by Snyk (werzeug==2.2.3 via moto==1.3.16). This required werzeug~=3.0.1, which is now installed as part of the dependency tree with the updated dependencies.

Note - the updates are only to dev.txt, which means there is no change to the services itself (and the good news is that the vulnerability wasn't in our service, but it is present in our CI/CD environment when running tests). These changes do not require a new version of the service to be created.

Second note - we should probably bump up the version of Python used in the service from 3.9.14 at some point. It would be great to get to 3.10 or, preferably, 3.11.

Jira Issue ID

N/A

Local Test Steps

• Check the tests complete successfully.
• Alternatively, run the scripts to run the tests (which should all pass):

./bin/build-image
./bin/build-test
./bin/run-test

PR Acceptance Checklist

• Jira ticket acceptance criteria met.
• Tests added/updated and passing.
• Documentation updated (if needed).
• version.txt and CHANGELOG.md updated (if publishing a new release).

[owenlittlejohns]

There was also a medium severity vulnerability in ipython. That should now be squashed.

There was one last medium severity vulnerability in setuptools, but when I ran things locally, the new versions of everything didn't look like they included setuptools, so that should also be squashed.

[owenlittlejohns]

When running the installation on my local machine (in a Python 3.9 environment), moto~=4.2.7 led to werkzeug==3.0.1, which mitigates the issue. However, Snyk still pulled in an older version of werkzeug when running the scan. I suspect it relates to Snyk running the scan under Python 3.7.

[flamingbear]

This isn't great, but I'm following along with the slack chat to see if we can resolve it differently for the future.

[flamingbear]

Build and ran the tests everything looks good for now. Hopefully we can get snyk version straightenend out.