[pre-commit.ci] pre-commit autoupdate

[pre-commit-ci]

updates:

• github.com/astral-sh/uv-pre-commit: 0.11.6 → 0.11.7
• github.com/astral-sh/ruff-pre-commit: v0.15.10 → v0.15.11

[amrit110]

Security Vulnerability — Partial Fix Applied

aieng-bot fixed 3 of 4 vulnerable packages. One vulnerability cannot be auto-fixed because of a hard pin in a dependency:

✅ Fixed

Package	Old Version	New Version	Vulnerability
pypdf	6.10.0	≥6.10.2	GHSA-jj6c-8h6c-hppx, GHSA-4pxv-j86v-mhcw, GHSA-7gw9-cf7v-778f, GHSA-x284-j5p8-9c5p (DoS via crafted PDFs)
google-adk	1.23.0	≥1.28.1	CVE-2026-4810 (code injection / missing authentication)
python-multipart	0.0.22	≥0.0.26	CVE-2026-40347 (DoS via crafted multipart preamble/epilogue)

❌ Cannot Fix — No Patch Available

Package	Version	Vulnerability	Status
authlib	1.6.9	GHSA-jj8c-mmj3-mmgv	Blocked: aieng-platform-onboard (all versions ≤0.6.5) pins authlib==1.6.9 exactly

Why this cannot be auto-fixed

aieng-platform-onboard>=0.6.3 requires authlib==1.6.9 (exact pin), which conflicts with the patched version authlib>=1.6.11. Upgrading authlib is impossible until aieng-platform-onboard releases a new version relaxing this pin.

Recommended next steps

1. Open an issue / PR against aieng-platform-onboard to update its authlib constraint to >=1.6.11
2. Once aieng-platform-onboard releases a compatible version, re-run aieng-bot to apply the final fix
3. As a temporary workaround, add GHSA-jj8c-mmj3-mmgv to the ignore-vulns list in .github/workflows/code_checks.yml with a justification comment (requires human review)

This PR will not be auto-merged until the authlib vulnerability is resolved.