chore: update some more cves

[mckornfield]

Summary

Pre-Review Checklist

Ensure that the following pass:

• mise run format && mise run check or via prek validation.
• mise run test passes locally
• mise run test:e2e passes locally
• mise run test:ci-container passes locally (recommended)
• GPU CI status check passes -- comment /sync on this PR to trigger a run (auto-triggers on ready-for-review)

Pre-Merge Checklist

• New or updated tests for any fix or new behavior
• Updated documentation for new features and behaviors, including docstrings for API docs.

Other Notes

• Closes #

Summary by CodeRabbit

• Chores
  • Updated underlying package compatibility requirements.
  • Added minimum supported versions for several optional integrations and security-related packages.
  • Removed an obsolete package constraint.

[coderabbitai]

Walkthrough

Updates Python dependency minimums and uv constraints in pyproject.toml, including additions, removals, and version increases for runtime and engine-related packages.

Changes

Dependency constraints

Layer / File(s)	Summary
Update dependency requirements pyproject.toml	Raises the pydantic-settings, cryptography, python-multipart, starlette, and tornado minimum versions; constrains json-repair; adds bleach and mcp; and removes prv-accountant.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels: security

Suggested reviewers: binaryaaron

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title is related to security dependency updates, but it is too vague to describe the actual change.	Use a specific title like "chore: bump dependencies to address additional CVEs" so the main change is clear.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cves-nss-0721/mck

---

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This PR bumps several transitive and direct dependency floor constraints to address CVEs. The changes are confined to pyproject.toml (constraint floors) and the auto-generated uv.lock (resolved versions), with no application code changes.

• Bumps direct dependency pydantic-settings from >=2.6.1 to >=2.14.2 (lock resolves to 2.14.2 from 2.13.1); adds minimum floors to json-repair, bleach, mcp as new constraint-dependencies; and raises floors on cryptography, python-multipart, starlette, and tornado.
• The lock file is fully consistent with all new constraint floors — every resolved version satisfies its updated specifier.

Confidence Score: 5/5

Safe to merge — all changes are dependency floor bumps with no application code modifications.

Every changed line is a version specifier or lock file entry. The uv.lock resolved versions are fully consistent with the updated constraint floors in pyproject.toml. The most notable jump is cryptography moving from 47.0.0 to 49.0.0 in the lock, but this satisfies the new >=48.0.1 floor and is the expected outcome of a CVE-driven upgrade.

No files require special attention.

Important Files Changed

Filename	Overview
pyproject.toml	Bumps pydantic-settings direct dep floor to >=2.14.2, adds json-repair floor in engine extras, and raises/adds several constraint-dependency floors (bleach, cryptography, mcp, python-multipart, starlette, tornado) to address CVEs.
uv.lock	Auto-generated lock file; resolved versions are consistent with all updated constraint floors — all packages satisfy their new minimum specifiers.

_{Reviews (1): Last reviewed commit: "chore: update some more cves" | Re-trigger Greptile}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

pyproject.toml (1)

31-31: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add inline rationale for changed dependency pins.

The new security and compatibility floors lack inline advisory, CVE, or issue references. Add a short rationale to each changed pin so future dependency updates do not lose the reason for the minimum version.

As per coding guidelines, **/*.toml requires dependency pins to be commented inline.

Also applies to: 92-92, 197-216

Source: Coding guidelines

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 326fa659-575f-4ec1-b29a-bfd509569e09

📥 Commits

Reviewing files that changed from the base of the PR and between d73679a and 1939eda.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock, !uv.lock

📒 Files selected for processing (1)

• pyproject.toml

📜 Review details

⏰ Context from checks skipped due to timeout. (4)

• GitHub Check: Greptile Review
• GitHub Check: Typecheck
• GitHub Check: Analyze (python)
• GitHub Check: Analyze (javascript-typescript)

🧰 Additional context used

📓 Path-based instructions (3)

pyproject.toml

📄 CodeRabbit inference engine (.cursor/rules/repo-navigation.mdc)

Configure package metadata, dependencies, extras (cpu/cu129/engine), and uv configuration in pyproject.toml

Run the lock-drift check when changing Python dependencies or pyproject.toml; keep uv.lock synchronized.

Files:

• pyproject.toml

---

⚙️ CodeRabbit configuration file

Treat pyproject.toml as high-risk. Check package metadata, uv indexes, dependency groups, optional extras, Python version bounds, hatch config, ty config, script entry points, dependency consistency, and whether changes require regenerating uv.lock.

Files:

• pyproject.toml

**/*.toml

📄 CodeRabbit inference engine (STYLE_GUIDE.md)

Use spaces around =, comment dependency pins inline, and follow the prescribed pyproject.toml section order.

Files:

• pyproject.toml

**/*

📄 CodeRabbit inference engine (STYLE_GUIDE.md)

**/*: Every source file requires the SPDX copyright and license header appropriate to its file format.
End files with a newline, remove trailing whitespace, use one space between sentences, and keep code, comments, and docstrings within 120 characters.

**/*: All contributions must use verified Git commits and DCO sign-off; unsigned or unsigned-off commits cannot be merged.
Branches other than main must follow <author>/<description>, optionally including an issue ID or type; branch names must use lowercase alphanumeric characters and hyphens.
Commits merged to main must follow Conventional Commits, using a valid lowercase type and a description of at most 100 characters.

Files:

• pyproject.toml

---

⚙️ CodeRabbit configuration file

**/*: Review as a senior maintainer for NeMo Safe Synthesizer. Prioritize issues that can change behavior, break user workflows, weaken privacy guarantees, hide failures, make tests unreliable, or create maintenance risk. Avoid generic style commentary unless it points to a concrete project convention that automated tools will not catch.
Comment only when the finding is actionable and tied to changed code. For each finding, state the impact, the condition that triggers it, and the smallest practical fix. Prefer one precise comment over broad advice. Do not ask for refactors outside the PR scope unless the changed code creates the problem.
Review type guidance: - Potential issue: use for correctness bugs, data loss, privacy leaks,
security risks, broken public APIs, invalid config behavior, missing
validation, hidden failures, nondeterministic tests, or CI breakage.

• Refactor suggestion: use for local maintainability problems introduced
  by the diff when they have clear future cost, such as duplicated setup,
  unclear boundaries, over-mocking, avoidable complexity, or opaque test
  helpers.
• Nitpick: avoid in chill mode. Do not emit formatting, import-order,
  wording, or style-only comments unless automated tools cannot catch the
  issue and it affects maintainability.

Severity guidance: - Critical: security/privacy leaks, data loss, training/test/holdout
contamination, or broken release/package/core pipeline execution.

• Major: incorrect generation/training/evaluation behavior, broken
  CLI/SDK public API, invalid config defaults or validators, or GPU/vLLM
  cleanup and process-isolation bugs likely to fail CI or production
  runs.
• Minor: localized bugs, missing focused tests for changed behavior, or
  bad test patterns that weaken regression coverage.
• Trivial: small cleanup with no behavior impact. Usually suppress in
  chill mode.
• Info: context only. Avoid unless it helps reviewers understand risk.
  Safe-Synthesizer-specific review focus: - Data ...

Files:

• pyproject.toml

🔇 Additional comments (2)

pyproject.toml (2)

92-92: 🎯 Functional Correctness

Verify the json-repair parsing contract at the new floor.

detect.py unwraps singleton lists returned by json_repair.loads before Pydantic validation. Add or confirm focused tests for singleton objects and fuzzy/malformed JSON using json-repair==0.60.1, since this dependency change can alter entity-type parsing.

As per path instructions, new behavior needs focused tests near the affected subsystem.

Source: Path instructions

---

31-31: 🗄️ Data Integrity & Integration

Run uv lock --check before merging. This dependency floor change in pyproject.toml needs the lockfile kept in sync across all extras and environments.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!