fix(deps): raise vulnerable dependency floors

[martinramos002-bot]

Summary

Raise vulnerable dependency floors and regenerate uv.lock from current main rather than reusing an older lockfile.

Direct/lazy-install pins are updated for:

• cryptography 48.0.1
• MCP 1.28.1
• Pillow 12.3.0
• pytest 9.0.3
• python-multipart 0.0.32
• Starlette 1.3.1
• setuptools 83.0.0

The targeted lock refresh also resolves patched Click, httplib2, pydantic-settings, Pygments, and Tornado releases. Root dashboard metadata now carries explicit FastAPI/Starlette/multipart security floors so lean installs cannot resolve below them.

Audit evidence

Auditing the previous environment found:

• PyPI advisory service: 43 vulnerabilities across 13 packages
• OSV: 58 vulnerability records across 13 packages

Auditing an isolated environment built from this PR leaves only PyNaCl 1.5.0:

• discord.py[voice] 2.7.1 requires PyNaCl>=1.5,<1.6
• the fixed PyNaCl release is 1.6.2

That residual is documented rather than bypassing the resolver or silently removing voice support.

Validation

• isolated Python 3.11 environment built from the regenerated frozen lock
• pytest -q tests/test_project_metadata.py tests/tools/test_computer_use.py tests/hermes_cli/test_web_server_host_header.py — 239 passed
• Ruff on changed Python/TOML paths — passed
• uv lock --check — passed
• uv pip check — all 93 installed packages compatible
• source distribution and wheel build — passed
• PyPI and OSV audit repeated against the isolated environment
• git diff --check — passed
• pre-publication sensitive-data scan — clean

[martinramos002-bot]

Validation update: head 667c2488b30da82e9d1d4122a2d16469c4d5e7c1 completed all 37 GitHub checks with 0 failures and 0 pending. Local validation: 239 focused tests passed, frozen lock and package compatibility checks passed, and wheel/sdist builds succeeded. PyPI and OSV re-audits leave only the documented PyNaCl constraint from discord.py[voice].

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[teknium1]

Thanks for the dependency-floor work. The remaining premise is still valid on current main, but this branch now requires conflict-aware salvage.

Problems

• Current main already contains part of this proposal: pyproject.toml:87 pins cryptography==48.0.1, and the web/MCP paths already use starlette==1.3.1 and web python-multipart==0.0.32 (pyproject.toml:229, :301). Commit 623762f2f0 landed that remediation.
• The remaining targets are still stale on main (pyproject.toml:105, :111, :125, :164, :229, :240, :337; tools/lazy_deps.py:279, :286). GitHub reports this PR as DIRTY, so its old-base lock snapshot cannot be reused unchanged.

Suggested changes

• Salvage the still-needed floors onto current metadata, preserve the already-landed remediation, and regenerate uv.lock from that reconciled state.
• Keep lazy-install pins synchronized with the project extras, using the existing parity contracts in tests/test_project_metadata.py:137-185 and :253-295.

Automated hermes-sweeper review.

[martinramos002-bot]

Rebased onto current main and reconciled only the dependency floors still missing there. Already-landed cryptography/Starlette/multipart remediation was preserved; lazy dependency specs and focused metadata expectations were updated, and uv.lock was regenerated with directed upgrades rather than conflict-edited. Verification on this head: uv lock --check; 87 focused metadata, computer-use, and web-host tests passed; syntax/TOML and git diff --check clean. The upstream build command remains gated by the repository's existing README/PyPI-description policy, unrelated to this diff.

[teknium1]

Thanks — all bumps here are implemented on main (mcp 1.28.1, Pillow 12.3.0, starlette 1.3.1, and the setuptools==83.0.0 move in both dev extra and build-system). Main's tests/test_packaging_metadata.py already carries the starlette security-floor invariants. Closing as implemented on main.