Discovered during a public-repo PR review sweep.
The security (pip-audit) job blocks #116 and #117. All findings are pre-existing transitive deps on main's lock (neither PR touches them):
uv lock --upgrade-package these, then merge #116 first (its python-deps bump also removes pydantic-settings GHSA-4xgf-cpjx-pc3j) then #117.
Discovered during a public-repo PR review sweep.
The
security(pip-audit) job blocks #116 and #117. All findings are pre-existing transitive deps onmain's lock (neither PR touches them):cryptography 48.0.0→ 48.0.1 (GHSA-537c-gmf6-5ccf)python-multipart 0.0.29→ 0.0.31 (CVE-2026-53538/-53539 → 0.0.30; CVE-2026-53540 → 0.0.31)starlette 1.0.1→ 1.3.1 (CVE-2026-48817/-48818 → 1.1.0; PYSEC-2026-248 → 1.3.0; PYSEC-2026-249 → 1.3.1)vcrpy 8.1.1→ 8.2.1 (GHSA-rpj2-4hq8-938g)uv lock --upgrade-packagethese, then merge #116 first (its python-deps bump also removes pydantic-settings GHSA-4xgf-cpjx-pc3j) then #117.