chore(deps): Update

[williaby]

Summary

Why

Scheduled patch update, bug fixes and security patches with no API changes.

Changes

This PR contains the following updates:

Change	Update
All locks refreshed	lockFileMaintenance

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Impact

• ✅ Patch update: bug fixes and security patches only
• ✅ No breaking changes

Acceptance Criteria

• All CI checks pass

Testing

• CI gates pass (tests, lint, type checking, security scan)

Notes

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "before 5am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[Copilot]

Copilot wasn't able to review any files in this pull request.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock, !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: fd8eaa38-d827-4a25-aa87-531b77a75bff

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/lock-file-maintenance

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​hypothesis@​6.155.2 ⏵ 6.155.7	+1
	pypi/​pymdown-extensions@​10.21.3 ⏵ 11.0	+1
	pypi/​pytest@​9.0.3 ⏵ 9.1.1	+1
	pypi/​google-auth@​2.53.0 ⏵ 2.55.1	+1
	pypi/​sentry-sdk@​2.61.1 ⏵ 2.63.0	+1
	pypi/​sqlalchemy@​2.0.50 ⏵ 2.0.51	+1
	pypi/​anyio@​4.13.0 ⏵ 4.14.1	+1
	pypi/​ipykernel@​7.2.0 ⏵ 7.3.0
	pypi/​pip-audit@​2.10.0 ⏵ 2.10.1	+1
	pypi/​alembic@​1.18.4 ⏵ 1.18.5	+1
	pypi/​pdfminer-six@​20251230 ⏵ 20260107	+1
	pypi/​redis@​8.0.0 ⏵ 8.0.1	+1
	pypi/​atheris@​3.0.0 ⏵ 3.1.0	+1
	pypi/​basedpyright@​1.39.7 ⏵ 1.39.9	+1
	pypi/​pdfplumber@​0.11.9 ⏵ 0.11.10
	pypi/​rq@​2.9.1 ⏵ 2.10.0
	pypi/​starlette@​1.2.1 ⏵ 1.3.1	+1	+17
	pypi/​fakeredis@​2.36.1 ⏵ 2.36.2	+1
	pypi/​ruff@​0.15.16 ⏵ 0.15.20
	pypi/​fastapi@​0.136.3 ⏵ 0.138.2	+1
	pypi/​pydantic-settings@​2.14.1 ⏵ 2.14.2	+1	+2
	pypi/​pydoclint@​0.8.6 ⏵ 0.9.0	+1

View full report

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 43 package(s) with unknown licenses.

See the Details below.

License Issues

uv.lock

Package	Version	License	Issue Type
alembic	1.18.5	Null	Unknown License
anyio	4.14.1	Null	Unknown License
basedpyright	1.39.9	Null	Unknown License
click	8.4.2	Null	Unknown License
cryptography	49.0.0	Null	Unknown License
cyclonedx-python-lib	11.11.0	Null	Unknown License
fakeredis	2.36.2	Null	Unknown License
fastapi	0.138.2	Null	Unknown License
filelock	3.29.4	Null	Unknown License
greenlet	3.5.3	Null	Unknown License
griffelib	2.1.0	Null	Unknown License
hypothesis	6.155.7	Null	Unknown License
ipykernel	7.3.0	Null	Unknown License
ipython	9.15.0	Null	Unknown License
json5	0.15.0	Null	Unknown License
jupyter-builder	1.0.2	Null	Unknown License
jupyter-client	8.9.1	Null	Unknown License
jupyter-server	2.20.0	Null	Unknown License
jupyterlab	4.6.1	Null	Unknown License
mistune	3.3.2	Null	Unknown License
mkdocstrings-python	2.0.5	Null	Unknown License
msgpack	1.2.1	Null	Unknown License
notebook	7.6.0	Null	Unknown License
pdfminer-six	20260107	Null	Unknown License
pip-audit	2.10.1	Null	Unknown License
prettytable	3.18.0	Null	Unknown License
pydantic-settings	2.14.2	Null	Unknown License
pydoclint	0.9.0	Null	Unknown License
pymdown-extensions	11.0	Null	Unknown License
pytest	9.1.1	Null	Unknown License
python-discovery	1.4.2	Null	Unknown License
pywinpty	3.0.5	Null	Unknown License
redis	8.0.1	Null	Unknown License
rq	2.10.0	Null	Unknown License
ruff	0.15.20	Null	Unknown License
sqlalchemy	2.0.51	Null	Unknown License
starlette	1.3.1	Null	Unknown License
tornado	6.5.7	Null	Unknown License
virtualenv	21.5.1	Null	Unknown License
wcwidth	0.8.2	Null	Unknown License
pypdfium2	5.11.0	Null	Unknown License
certifi	2026.6.17	Null	Unknown License
distlib	0.4.3	Null	Unknown License

Denied Licenses:

GPL-2.0, GPL-3.0

OpenSSF Scorecard

Scorecard details

Package	Version	Score	Details
pip/alembic	1.18.5	Unknown	Unknown
pip/anyio	4.14.1	Unknown	Unknown
pip/atheris	3.1.0	🟢 6.2	Details Check Score Reason Code-Review 🟢 7 Found 23/30 approved changesets -- score normalized to 7 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Maintained 🟢 3 3 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 3 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege SAST ⚠️ 0 no SAST tool detected Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing 🟢 10 project is fuzzed License 🟢 10 license file detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 10 security policy file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches
pip/basedpyright	1.39.9	Unknown	Unknown
pip/certifi	2026.6.17	🟢 5.9	Details Check Score Reason Code-Review ⚠️ 0 Found 0/2 approved changesets -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Binary-Artifacts 🟢 10 no binaries found in the repo Maintained 🟢 8 10 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 8 Pinned-Dependencies 🟢 5 dependency not pinned by hash detected -- score normalized to 5 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found License 🟢 9 license file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Packaging 🟢 10 packaging workflow detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
pip/click	8.4.2	Unknown	Unknown
pip/coverage	7.14.3	Unknown	Unknown
pip/cryptography	49.0.0	Unknown	Unknown
pip/cyclonedx-python-lib	11.11.0	Unknown	Unknown
pip/distlib	0.4.3	Unknown	Unknown
pip/fakeredis	2.36.2	Unknown	Unknown
pip/fastapi	0.138.2	Unknown	Unknown
pip/filelock	3.29.4	Unknown	Unknown
pip/google-auth	2.55.1	🟢 6.9	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 10 all changesets reviewed CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Packaging ⚠️ -1 packaging workflow not detected Security-Policy 🟢 10 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Fuzzing 🟢 10 project is fuzzed Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0
pip/greenlet	3.5.3	Unknown	Unknown
pip/griffelib	2.1.0	Unknown	Unknown
pip/hypothesis	6.155.7	Unknown	Unknown
pip/ipykernel	7.3.0	Unknown	Unknown
pip/ipython	9.15.0	Unknown	Unknown
pip/json5	0.15.0	Unknown	Unknown
pip/jupyter-builder	1.0.2	Unknown	Unknown
pip/jupyter-client	8.9.1	Unknown	Unknown
pip/jupyter-server	2.20.0	Unknown	Unknown
pip/jupyterlab	4.6.1	Unknown	Unknown
pip/mistune	3.3.2	Unknown	Unknown
pip/mkdocstrings-python	2.0.5	Unknown	Unknown
pip/msgpack	1.2.1	Unknown	Unknown
pip/nest-asyncio2	1.7.2	Unknown	Unknown
pip/notebook	7.6.0	Unknown	Unknown
pip/pdfminer-six	20260107	Unknown	Unknown
pip/pdfplumber	0.11.10	🟢 4.4	Details Check Score Reason Maintained 🟢 5 4 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 5 Code-Review ⚠️ 0 Found 1/29 approved changesets -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Fuzzing 🟢 10 project is fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
pip/pip-audit	2.10.1	Unknown	Unknown
pip/prettytable	3.18.0	Unknown	Unknown
pip/protobuf	7.35.1	Unknown	Unknown
pip/pydantic-settings	2.14.2	Unknown	Unknown
pip/pydoclint	0.9.0	Unknown	Unknown
pip/pymdown-extensions	11.0	Unknown	Unknown
pip/pypdfium2	5.11.0	🟢 4.2	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10 Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions SAST ⚠️ 0 no SAST tool detected Pinned-Dependencies ⚠️ 1 dependency not pinned by hash detected -- score normalized to 1 Fuzzing ⚠️ 0 project is not fuzzed License 🟢 9 license file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Security-Policy ⚠️ 0 security policy file not detected Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Packaging 🟢 10 packaging workflow detected
pip/pytest	9.1.1	Unknown	Unknown
pip/python-discovery	1.4.2	Unknown	Unknown
pip/pywinpty	3.0.5	Unknown	Unknown
pip/redis	8.0.1	Unknown	Unknown
pip/rq	2.10.0	Unknown	Unknown
pip/ruff	0.15.20	Unknown	Unknown
pip/sentry-sdk	2.63.0	🟢 5.8	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 8 Found 24/28 approved changesets -- score normalized to 8 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 9 dependency not pinned by hash detected -- score normalized to 9 Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Branch-Protection 🟢 4 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Security-Policy 🟢 10 security policy file detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
pip/sqlalchemy	2.0.51	Unknown	Unknown
pip/starlette	1.3.1	Unknown	Unknown
pip/tornado	6.5.7	Unknown	Unknown
pip/virtualenv	21.5.1	Unknown	Unknown
pip/wcwidth	0.8.2	Unknown	Unknown

Scanned Files

• uv.lock

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud