gradient-labs dependabot alert remediation 2026-06-01

[github-actions]

Summary

Remediates 4 production Dependabot alerts by bumping pytest directly and adding/raising urllib3/idna constraints in [tool.uv].constraint-dependencies (both pulled transitively via requests). Lockfile regenerated with uv lock.

Alert	Severity	Package	Old version	New version	Ecosystem	Manifest updated
#17	medium	pytest	8.3.4	9.0.3	pip	pyproject.toml (+ uv.lock)
#18	high	urllib3	2.6.3	2.7.0	pip	pyproject.toml (+ uv.lock)
#19	high	urllib3	2.6.3	2.7.0	pip	pyproject.toml (+ uv.lock)
#20	medium	idna	3.10	3.17	pip	pyproject.toml (+ uv.lock)

Notes:

• Dependabot reports the manifest as uv.lock for all four alerts. uv.lock is not listed in manifests.txt, but per the workflow instructions the appropriate uv manifest (./pyproject.toml, which is in manifests.txt) was edited and the lock was regenerated. No alerts were skipped as stale.
• Alerts Add datetime to start, assign, and end functions #18 and Release python-client v0.6.0 #19 are overlapping ranges for the same urllib3 CVE; both are resolved by the single bump to 2.7.0. idna resolved to 3.17 (>= 3.15 constraint).

Test plan

• CI passes on the branch (lint + tests)
• uv sync resolves cleanly for downstream consumers
• Confirm Dependabot closes alerts Bump idna from 3.4 to 3.7 #17, Add datetime to start, assign, and end functions #18, Release python-client v0.6.0 #19, Bump requests from 2.31.0 to 2.32.2 #20 after merge

🤖 Generated with Claude Code