chore(deps): upgrade all project dependencies

[CybotTM]

Summary

• uv lock --upgrade: 30 packages updated within existing constraints
• pip 26.1 → 26.1.2 — fixes the path-traversal advisory behind Dependabot alert #19
• mypy 1.20.1 → 2.3.0 (major): reports the same 9 pre-existing findings in 4 files; the CI mypy step stays continue-on-error
• pre-commit: black hook 26.3.1 → 26.5.1 to match the lockfile; isort left at 8.0.1 (autoupdate offered only the 9.0.0b1 pre-release)

Verification

• uv run python -m pytest — 662 passed, 1 skipped
• uv run python -m flake8 cli_audit tests --select=E9,F63,F7,F82 — 0
• ./scripts/test_smoke.sh — OK
• uv run python audit.py --help — OK

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 17 package(s) with unknown licenses.

See the Details below.

License Issues

uv.lock

Package	Version	License	Issue Type
ast-serialize	0.6.0	Null	Unknown License
black	26.5.1	Null	Unknown License
cffi	2.1.0	Null	Unknown License
charset-normalizer	3.4.9	Null	Unknown License
click	8.4.2	Null	Unknown License
cyclonedx-python-lib	11.11.0	Null	Unknown License
filelock	3.30.2	Null	Unknown License
jaraco-functools	4.6.0	Null	Unknown License
librt	0.13.0	Null	Unknown License
mypy	2.3.0	Null	Unknown License
pathspec	1.1.1	Null	Unknown License
pip	26.1.2	Null	Unknown License
pip-audit	2.10.1	Null	Unknown License
platformdirs	4.10.0	Null	Unknown License
pytest	9.1.1	Null	Unknown License
stevedore	5.9.0	Null	Unknown License
typing-extensions	4.16.0	Null	Unknown License

OpenSSF Scorecard

Scorecard details

Package	Version	Score	Details
pip/ast-serialize	0.6.0	Unknown	Unknown
pip/black	26.5.1	Unknown	Unknown
pip/build	1.5.0	Unknown	Unknown
pip/certifi	2026.6.17	🟢 5.7	Details Check Score Reason Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Security-Policy 🟢 10 security policy file detected Maintained 🟢 6 8 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 6 Code-Review ⚠️ 0 Found 0/2 approved changesets -- score normalized to 0 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies 🟢 5 dependency not pinned by hash detected -- score normalized to 5 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 9 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Packaging 🟢 10 packaging workflow detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
pip/cffi	2.1.0	Unknown	Unknown
pip/charset-normalizer	3.4.9	Unknown	Unknown
pip/click	8.4.2	Unknown	Unknown
pip/coverage	7.15.2	Unknown	Unknown
pip/cryptography	49.0.0	Unknown	Unknown
pip/cyclonedx-python-lib	11.11.0	Unknown	Unknown
pip/docutils	0.23	Unknown	Unknown
pip/filelock	3.30.2	Unknown	Unknown
pip/idna	3.18	Unknown	Unknown
pip/jaraco-functools	4.6.0	Unknown	Unknown
pip/librt	0.13.0	Unknown	Unknown
pip/markdown-it-py	4.2.0	Unknown	Unknown
pip/more-itertools	11.1.0	Unknown	Unknown
pip/mypy	2.3.0	Unknown	Unknown
pip/nh3	0.3.6	Unknown	Unknown
pip/packaging	26.2	Unknown	Unknown
pip/pathspec	1.1.1	Unknown	Unknown
pip/pip	26.1.2	Unknown	Unknown
pip/pip-audit	2.10.1	Unknown	Unknown
pip/platformdirs	4.10.0	Unknown	Unknown
pip/pytest	9.1.1	Unknown	Unknown
pip/readme-renderer	45.0	Unknown	Unknown
pip/requests	2.34.2	Unknown	Unknown
pip/stevedore	5.9.0	Unknown	Unknown
pip/typing-extensions	4.16.0	Unknown	Unknown

Scanned Files

• uv.lock

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.