[jonahgabriel]

Summary

Closes all 14 open Dependabot alerts on omnimemory (8 high / 4 medium / 2 low). Lockfile only — no source or pyproject.toml change; every bump sits inside constraints already declared.

Ticket: OMN-17184

Alerts	Sev	Package	Was → Now	CVE
#21, #23	high	Mako	1.3.10 → 1.4.1	CVE-2026-41205, CVE-2026-44307
#48, #49, #50	high	pyasn1	0.6.3 → 0.6.4	CVE-2026-59884/59885/59886
#25, #26	high	urllib3	2.6.3 → 2.7.0	CVE-2026-44431, CVE-2026-44432
#3	high	deepdiff	8.6.1 → 9.1.0	CVE-2026-33155
#47	high	mcp	1.27.2 → 1.29.1	CVE-2026-59950
#5	medium	requests	2.32.5 → 2.34.2	CVE-2026-25645
#28	medium	tuf	6.0.0 → 7.0.0	GHSA-qp9x-wp8f-qgjj
#57	medium	h2	4.3.0 → 4.4.1	CVE-2026-71554
#27	medium	idna	3.11 → 3.19	CVE-2026-45409
#7	low	Pygments	2.19.2 → 2.21.0	CVE-2026-4539

mcp was deliberately held inside 1.x

pyproject.toml declares mcp>=1.27.2,<3.0.0, so an unconstrained upgrade resolves to 2.1.1 and drags in httpx2, httpcore2, httpx2-jsfetch and mcp-types — a transport swap, not a security patch. Alert #47 only needs >= 1.28.1, so the bump was pinned <2 and lands on 1.29.1 with zero new packages.

Two majors are deliberate and both are transitive-only: deepdiff 8→9 matches the version omnibase_infra already runs on dev, and tuf 6→7 arrives through sigstore — nothing here imports either directly.

Verification

• uv lock --check clean; uv sync --all-extras resolves
• uv run pytest tests/unit — 1233 passed, 0 failed
• Governed pre-push selector (OMN-13973) ran and passed. No PREPUSH_* override, no --no-verify.

Context

One of six PRs closing 141 open Dependabot alerts org-wide under OMN-17184. The ticket originally scoped only omnidash's 39; a live sweep of all 14 registry repos found 141 across six.

Evidence-Ticket: OMN-17184
Evidence-Source: OCC#7794

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 55f7c593-8461-4282-b61c-a5f873648789

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}