v1.34.6 — dependency security refresh (pip-audit clean)

Pin transitive deps flagged by pip-audit that dependabot cannot see
(not in requirements.txt): pyjwt 2.13.0 (6 PYSEC), pydantic-settings
2.14.2 (GHSA-4xgf-cpjx-pc3j), idna 3.15 (PYSEC-2026-215), msgpack
1.2.1 (GHSA-6v7p-g79w-8964). Rides on top of dependabot bumps #55-#58
(fastapi 0.138.1, mcp 1.28.1, click 8.4.2, phonenumbers 9.0.33).

2602 pytest passed, ruff clean, pip-audit: no known vulnerabilities.

Author: UPinar

app/config.py

@@ -12,7 +12,7 @@
 from pydantic import Field
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
-VERSION = "1.34.5"
+VERSION = "1.34.6"
 MCP_TOOL_COUNT = 54  # Faz-2: +contrast_scan (website-scanner composite)
 MCP_RESOURCE_COUNT = 7  # v1.23.0: atlas+d3fend+cwe (4 templates + 3 catalogs)
 MCP_PROMPT_COUNT = 3  # v1.23.0: security_audit, vulnerability_check, contrast_triage

requirements.txt

@@ -6,11 +6,15 @@ jinja2==3.1.6
 python-multipart==0.0.32
 dnspython==2.8.0
 httpx==0.28.1
+idna==3.15
+msgpack==1.2.1
 pytest==9.1.1
 phonenumbers==9.0.33
 cryptography==49.0.0
 cvss==3.6
 mcp==1.28.1
+pyjwt==2.13.0
+pydantic-settings==2.14.2
 PyYAML>=6.0.3
 tldextract>=5.3.1
 beautifulsoup4>=4.15.0