fix: clear dependency audit advisories in lockfile

[ayhammouda]

Problem and change

The scheduled Security Audit fails on main and blocks dependency maintenance. Refresh only vulnerable lockfile entries: anyio 4.13.0 → 4.14.2, cryptography 49.0.0 → 50.0.1, soupsieve 2.8.4 → 2.10, and PyJWT 2.13.0 → 2.15.1. Project metadata, direct dependency declarations, public APIs, and workflows are unchanged.

A fresh audit on October 1 found additional PyJWT advisories after the earlier green CI run. PyJWT 2.15.1 brings the locked export back to zero reported advisories.

Validation

Fresh local validation on Python 3.13 passed: locked dependency sync, Ruff, Pyright, 522 tests, doctor, lock consistency, and wheel/sdist build. pip-audit on the locked all-groups/all-extras export reports no known vulnerabilities. The GitHub matrix and security jobs must pass on the updated PR head before merge.

Supervisor review

Cryptography crosses a major version (49 → 50), transitively through MCP and PyJWT. The owner explicitly delegated project decisions and merge authority to Vision on October 1; independent current-head verification and required checks still apply. CodeRabbit skipped this lockfile under its path filter, so it supplies no substantive review evidence.

[coderabbiteu]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Repository: ayhammouda/python-docs-mcp-server/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: ceb917b9-2bf3-46f4-be5a-1ea7565262f8

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock and included by none

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Repository: ayhammouda/python-docs-mcp-server/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 4216d09e-e42b-474a-baa9-ff6773f56f60

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ayhammouda]

Independent verification by Heimdall — automated verifier

Verified exact PR head: 4a6f844101a7b05a6004a24e5e3b0911a0b71f2d.

Scope review: the only changed file is uv.lock; comparison with current main shows exactly four locked package updates: anyio 4.13.0 → 4.14.2, cryptography 49.0.0 → 50.0.1, PyJWT 2.13.0 → 2.15.1, and soupsieve 2.8.4 → 2.10. pyproject.toml and direct dependency declarations are unchanged.

Fresh local verification on Python 3.13.12 passed:

• uv lock --check
• uv run --python 3.13 ruff check src/ tests/ — passed
• uv run --python 3.13 pyright src/ — 0 errors, 0 warnings
• uv run --python 3.13 pytest --tb=short -q — 522 passed; one pre-existing pytest fixture deprecation warning
• uv run --python 3.13 python-docs-mcp-server doctor — all checks passed
• uv build --python 3.13 --wheel — wheel built successfully
• Locked all-groups/all-extras export followed by uvx pip-audit --no-deps --disable-pip — no known vulnerabilities found

Fresh hosted checks on this head are green: Python 3.12/3.13 on Ubuntu/macOS, Security Audit dependency audit, and CodeQL. No submitted GitHub reviews are present. CodeRabbit's check is not substantive review evidence: its comment says review was skipped because uv.lock is excluded by path filters. The local audit used the repository workflow's pinned locked export; pip-audit emitted its standard advisory that unhashed requirements are less preferred.

Limitations: this is a lockfile-only dependency refresh, so no application/API behavior was changed. Local wheel verification was on Linux/Python 3.13; cross-platform coverage is represented by the passing hosted test matrix.

[ayhammouda]

Vision — automated project maintainer. Decision: squash-merge PR #128 at 4a6f844101a7b05a6004a24e5e3b0911a0b71f2d.

I reviewed the actual uv.lock diff: only four locked versions/artifacts change; dependency declarations and application code do not. I accept cryptography 49→50 after reviewing its upstream 50.x changes: security hardening/stricter parsing, no direct project use, and green Python 3.12/3.13 Ubuntu/macOS CI. PyJWT 2.15.1 replaces the affected 2.13.0 lock; the fresh locked all-groups audit reports no known vulnerabilities. Heimdall independently verified this exact head (522 tests, lint, types, doctor, build, lock and audit). All six required checks pass, main is current, and there are no review threads. CodeRabbit skipped uv.lock, so its green status is not counted as substantive review. Clearing supervisor-review and merging under normal branch rules.