chore(deps): Update

[williaby]

Summary

Why

Scheduled patch update, bug fixes and security patches with no API changes.

Changes

This PR contains the following updates:

Change	Update
All locks refreshed	lockFileMaintenance

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Impact

• ✅ Patch update: bug fixes and security patches only
• ✅ No breaking changes

Acceptance Criteria

• All CI checks pass

Testing

• CI gates pass (tests, lint, type checking, security scan)

Notes

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "before 5am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[Copilot]

Copilot wasn't able to review any files in this pull request.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock, !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 7764f5ce-6e1d-4f9f-ada6-94dc073eca98

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/lock-file-maintenance

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​pytest@​9.0.3 ⏵ 9.1.0	+1
	pypi/​pip-audit@​2.10.0 ⏵ 2.10.1	+1
	pypi/​basedpyright@​1.39.6 ⏵ 1.39.8
	pypi/​ruff@​0.15.15 ⏵ 0.15.17
	pypi/​pydoclint@​0.8.4 ⏵ 0.8.6	+1

View full report

[github-actions]

Dependency Review

The following issues were found:

• ❌ 1 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 13 package(s) with unknown licenses.

See the Details below.

Vulnerabilities

uv.lock

Name	Version	Vulnerability	Severity
msgpack	1.2.0	MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error	high

Only included vulnerabilities with severity high or higher.

License Issues

uv.lock

Package	Version	License	Issue Type
msgpack	1.2.0	Null	Unknown License
basedpyright	1.39.8	Null	Unknown License
cyclonedx-python-lib	11.10.0	Null	Unknown License
filelock	3.29.4	Null	Unknown License
idna	3.18	Null	Unknown License
pip-audit	2.10.1	Null	Unknown License
pydoclint	0.8.6	Null	Unknown License
pytest	9.1.0	Null	Unknown License
python-discovery	1.4.2	Null	Unknown License
ruff	0.15.17	Null	Unknown License
typer	0.26.7	Null	Unknown License
virtualenv	21.5.0	Null	Unknown License
distlib	0.4.3	Null	Unknown License

Allowed Licenses:

MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, MPL-2.0, LGPL-2.1, LGPL-3.0, Python-2.0, Unlicense, CC0-1.0, GPL-3.0-or-later

Excluded from license check:

pkg:pypi/codespell

OpenSSF Scorecard

Scorecard details

Package	Version	Score	Details
pip/msgpack	1.2.0	Unknown	Unknown
pip/basedpyright	1.39.8	Unknown	Unknown
pip/cyclonedx-python-lib	11.10.0	Unknown	Unknown
pip/distlib	0.4.3	Unknown	Unknown
pip/filelock	3.29.4	Unknown	Unknown
pip/idna	3.18	Unknown	Unknown
pip/pip-audit	2.10.1	Unknown	Unknown
pip/pydoclint	0.8.6	Unknown	Unknown
pip/pytest	9.1.0	Unknown	Unknown
pip/python-discovery	1.4.2	Unknown	Unknown
pip/ruff	0.15.17	Unknown	Unknown
pip/typer	0.26.7	Unknown	Unknown
pip/virtualenv	21.5.0	Unknown	Unknown

Scanned Files

• uv.lock