chore(deps): bump the python-minor-patch group with 6 updates

apps/api/pyproject.toml

@@ -38,7 +38,7 @@ dependencies = [
     # Adaptive Orchestration — the provider-agnostic tier -> model router
     # (ao-settings-api's routing-preview resolves a concrete model through it).
     "forge-agent",
-    "fastapi>=0.139.0",
+    "fastapi>=0.139.2",
     "uvicorn[standard]>=0.51.0",
     "pydantic-settings>=2.2",
     "sqlalchemy>=2.0",

apps/mcp-gateway/pyproject.toml

@@ -11,7 +11,7 @@ dependencies = [
     "forge-mcp",
     # F38 — metrics facade (forge_mcp_* emission) + telemetry init.
     "forge-obs",
-    "fastapi>=0.139.0",
+    "fastapi>=0.139.2",
     "uvicorn[standard]>=0.51.0",
 ]
 

packages/agent-runtime/pyproject.toml

@@ -19,7 +19,7 @@ dependencies = [
 # adapter modules so the hermetic default suite needs neither installed. Install
 # with `uv sync --extra providers` to run the `pytest -m live_model` lane.
 providers = [
-    "anthropic>=0.49",
+    "anthropic>=0.117.0",
     "openai>=2.45.0",
 ]
 

pyproject.toml

@@ -37,20 +37,20 @@ dev = [
     "pytest>=8.0",
     "pytest-asyncio>=0.23",
     "pytest-cov>=5.0",
-    "ruff>=0.15.21",
-    "mypy>=2.2.0",
+    "ruff>=0.15.22",
+    "mypy>=2.3.0",
     "httpx>=0.27",
     # Validates the Helm chart values files against deploy/helm/forge/values.schema.json (F24).
     "jsonschema>=4.0",
     "pyyaml>=6.0",
     "bandit>=1.9.4",
     "pip-audit>=2.10.1",
     "cyclonedx-bom>=7.3.0",
-    "semgrep>=1.169.0",
+    "semgrep>=1.170.0",
     # HARD-12: single-source-of-truth versioning + conventional-commit lint +
     # SemVer bump + CHANGELOG generation. `uv run cz …` works with no global
     # install. Drives `make bump` / `make changelog` / the CI commit-lint step.
-    "commitizen>=3.29",
+    "commitizen>=4.16.5",
 ]
 
 # The workspace root is a virtual project: its dependencies (every member) are