[araa47]

Dependency + security refresh

Bumped packages (uv.lock)

Package	Old → New
pytest-asyncio	0.21.2 → 1.4.1 (dropped <0.23 pin in pyproject)
Pillow	12.2.0 → 13.0.0
reportlab	5.0.0 → 5.1.0
typer	0.26.8 → 0.27.3
aiohttp	3.14.1 → 3.14.5
multidict	6.7.1 → 7.2.1
uvloop	0.22.1 → 0.23.0
ruff	0.15.20 → 0.17.3
ty	0.0.55 → 0.0.95
prek	0.4.5 → 0.5.9
pytest	9.1.1 → 9.2.0
coverage	7.14.3 → 7.17.0
pygments	2.20.0 → 2.21.0
charset-normalizer	3.4.7 → 3.5.2
aiohappyeyeballs, annotated-doc, idna, iniconfig, packaging, pluggy, propcache, tomli, typing-extensions, yarl	minor/patch bumps
backports-asyncio-runner	new (transitive, pytest-asyncio on py<3.11)

Pre-commit hooks

Hook	Old → New
uv-pre-commit	0.11.26 → 0.13.6
black	26.5.1 → 26.10.1
isort	8.0.1 → 9.0.2
codespell	v2.4.2 → v2.4.3
ruff-pre-commit	v0.15.20 → v0.17.3
pre-commit-terraform	v1.108.0 → v1.109.4

GitHub Actions

actions/checkout v4 → v7, astral-sh/setup-uv v5 → v10.3.3 (no floating v10 tag exists), actions/cache v4 → v6.

Security

• pip-audit on the exported lock (all extras): no known vulnerabilities. osv-scanner not available.
• Workflows: no untrusted github.event.* interpolation, no pull_request_target. Removed unused id-token: write and added explicit permissions: contents: read to the prek job.

Held back

• ruff-pre-commit v0.17.4 and uv-pre-commit 0.13.7: published < 7 days ago, kept under the cooldown.
• isort 10.0.0: beta only.

Tests run

uv lock --upgrade && uv sync --all-extras --dev
uv run pytest -q          # 32 passed
uv run prek run --all-files   # all passed
uv export --frozen --no-hashes --all-extras > /tmp/req.txt && uvx pip-audit -r /tmp/req.txt --no-deps
uv build                  # sdist + wheel OK

Changelog: added an Unreleased entry.

🤖 Generated with Claude Code