[hironow]

Scope

One rollup for the four open Dependabot PRs (#78 aiohttp 3.14.4, #79 hypothesis 6.169.1, #80 ty 0.0.87, #81 github-actions group). No eMudhra-related pin changes are needed here (this repository's locks carry no stale certifi). No unrelated fixes.

• Workflow files (ci/benchmark/release) are byte-identical to ci: bump the github-actions group with 2 updates #81; both action pins were verified against official tag APIs (setup-uv v10.3.0, mise-action v5.1.2).
• pyproject.toml is byte-identical to chore(deps-dev): bump ty from 0.0.86 to 0.0.87 #80 (ty 0.0.87 in the lint group; ty is already exempt from this repo's 7-day cooldown by its own policy).
• The lock was re-resolved natively with the CI-pinned uv 0.11.17 and targeted upgrades. Result exactly matches the union of the three lock bots plus one constraint-forced transitive: aiohttp 3.14.4 (requires yarl>=1.25.1, matching chore(deps): bump aiohttp from 3.14.3 to 3.14.4 in the uv group across 1 directory #78's own lock), hypothesis 6.169.1, ty 0.0.87, yarl 1.25.1. Package set unchanged (56 records, none added/removed).
• packages/tablecodec-docling/uv.lock gained one mechanical line: bot chore(deps-dev): bump ty from 0.0.86 to 0.0.87 #80's root ty specifier change is embedded in the bridge lock's local-package metadata (requires-dev), and the first CI run failed the docling bridge job on exactly that drift. Verified at base (check passes) vs this head (fails) before the one-line regeneration; after it, uv lock --check (uv 0.11.17) and just docling-ci (30 tests) pass locally. Package set unchanged (41 records).
• Full re-resolution regenerated two transitive dependency-marker lines (anyio, httpcore2 gain sys_platform != 'emscripten' exclusions) — an artifact of the pinned uv's current resolver; versions and artifacts are unchanged, and the repo's own uv lock --check accepts the result.

Verification

• PASS: uv 0.11.17 uv lock --check and CI-parity uv sync --locked --group lint --extra dev --extra cli --extra teds.
• PASS: just ci on the final tree — ruff lint/format, ty, pytest 349 passed (2 benchmark deselected by design), semgrep (0 findings), rule fixtures 3/3, docs-check regenerated tables identical. (An earlier local failure was an invocation mismatch — dev/cli are extras, not groups; no repo change was needed.)
• PASS: independent Codex static review for PR publication (not merge approval) covered the original five-file diff — no deployment on main push (benchmarks only), release tag-only, zero-dependency core and cooldown policy intact, lock contains exactly the intended versions; the sixth file (bridge lock metadata line) is a mechanical consequence proven by the base-vs-head check above.

Merge boundary

All related checks on the final head must succeed. Recheck base/head and all workflow paths, then use a SHA-matched squash merge only if no main-triggered deployment risk exists (benchmark.yaml runs benchmarks on main push; release.yaml is v*-tag-only). No tag/release/publish is authorized. Close #78–#81 only after merged main is verified to contain their changes.

[hironow]

Diagnosed the first CI run: the docling bridge job failed because bot #80 changes the root ty specifier, which is embedded in packages/tablecodec-docling/uv.lock local-package metadata; verified at base (check passes) vs previous head (fails), regenerated that one line with the CI-pinned uv 0.11.17, and locally re-passed uv lock --check + just docling-ci (30 tests). Amended commit aa664da.