chore(deps): aggregate envs dependabot updates

[burtenshaw]

@.codex-dependabot-pr-body.md

[bot-ci-comment]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[cursor]

Alignment Review Report

Aggregate Dependabot roll-up (codex/dependabot-envs-*) touching only 2 lockfiles — envs/qed_math_env/uv.lock and envs/terminus_env/uv.lock. No source, docs, or pyproject.toml changes. Verified end-to-end: uv lock --check passes for both envs, every bumped hash matches PyPI exactly, and every bump closes a known advisory.

Automated Checks

• Lint: PASS (N/A to this PR). .claude/hooks/lint.sh exits 1, but only on ~20 pre-existing reformat candidates in unrelated .py files (e.g. opencode_env/*, and terminus_env/server/terminus_env_environment.py — not touched here). This PR changes only uv.lock (TOML), which ruff/usort don't process.
• Debug code: CLEAN. check-debug.sh hits are all in src/ (build.py console output + pre-existing TODOs); this PR touches zero src/ files.
• Lock integrity: PASS. uv lock --check → qed 142 pkgs, terminus 127 pkgs resolved (exit 0).

Open RFCs Context

Current RFCs: 000-project-phases, 001-abstractions, 002-env-spec, 003-mcp-support (In Review); 004-rubrics; 005-agentic-harnesses (In Review); 010-echo-env-token-world-model (Draft). None govern dependency management, packaging, or the PyPI index → no RFC surface touched.

Tier 1: Fixes Required

None. Exact package deltas (all transitive; no pyproject.toml pins on any bumped package, so lock-only is correct):

• qed_math_env (142→141): starlette 0.52.1→1.3.1, pydantic-settings 2.13.1→2.14.2, python-multipart 0.0.22→0.0.31 (the 3 committed bumps) + starlette-driven transitive re-resolution gradio 6.9.0→6.19.0 / gradio-client 2.3.0→2.5.0, +hf-gradio 0.4.1, −aiofiles −ffmpy. All hashes verified vs PyPI, none yanked.
• terminus_env (125→125, 0 add/remove): joserfc 1.6.4→1.6.8 only.

Tier 2: Alignment Discussion

Principle Conflicts

ALIGNMENT FLAG: index-source flip in envs/terminus_env/uv.lock (see inline on line 2)

• Principle at stake: PRINCIPLES.md L15 "Container isolation for reproducibility" (provenance / reproducible resolution).
• The concern: the whole terminus lock was regenerated against public PyPI — every source moves from the internal mirror https://pypi.registries.huggingface.tech/ → https://pypi.org/simple (132 refs) and revision bumps 2→3. Artifact URLs stay on files.pythonhosted.org with unchanged hashes, so it's almost certainly benign, but it silently changes the env's declared provenance and widens the cross-env split (qed's lock was already fully on pypi.org/simple, so no flip there). No committed config pins the mirror — it lives only inside uv.lock — so this is a resolver-environment artifact, not an intended config change. Registry choice is a team decision → flagging, not fixing.
• Suggested reviewers: @Darktex (reproducibility principle, git blame → b1a92e1) / @burtenshaw (owns dependabot.yml + the aggregate roll-up tooling).

Not flagged: the exclude-paths: ["envs/**"] bypass — this is the intended aggregate codex/dependabot-envs-* path, i.e. the correct way to update env locks given that native Dependabot doesn't honor exclude-paths for the uv ecosystem.

RFC Conflicts

None identified.

Security note (positive signal)

Every bump clears known advisories:

• python-multipart 0.0.22→0.0.31 — 5 DoS/parsing CVEs (CVE-2026-40347/42561/53538/53539/53540).
• starlette 0.52.1→1.3.1 — CVE-2026-48710 (fix 1.0.1), 48817/48818 (1.1.0), 54282 (1.3.0), 54283 (1.3.1); 1.3.1 is exactly the floor clearing the ladder (explains the major jump).
• pydantic-settings 2.13.1→2.14.2 — GHSA-4xgf-cpjx-pc3j (secrets-dir path traversal).
• joserfc 1.6.4→1.6.8 — CVE-2026-48990 (RFC7797 b64=false DoS).
• gradio 6.9.0→6.19.0 — CVE-2026-48545.

Optional fleet FYI (out of scope, cc @burtenshaw): terminus_env still ships gradio 6.13.0 (< 6.15.0), which remains affected by CVE-2026-48545 — the same advisory this roll-up fixes in qed.

Summary

• 0 mechanical issues (Tier 1)
• 1 alignment point (Tier 2): terminus index-source flip (reproducibility)
• 0 RFC conflicts

Clean, security-motivated dependency roll-up; verified end-to-end.

  

_{Sent by Cursor Automation: Pre-review}

[cursor]

Security-driven major bump — verified. starlette 0.52.1 → 1.3.1 is a major-version jump, but justified: 0.52.1 is affected by CVE-2026-48710 (fixed 1.0.1), CVE-2026-48817 / CVE-2026-48818 (1.1.0), CVE-2026-54282 (1.3.0) and CVE-2026-54283 (1.3.1) — 1.3.1 is exactly the floor that clears the whole ladder. Hashes match PyPI (wheel c7372aa…, sdist 05d0213…), not yanked, no open advisories; uv lock --check passes (142 pkgs).

Heads-up for reviewers: bumping starlette to 1.x forced a transitive re-resolution not reflected in the commit subjects — this lock also moves gradio 6.9.0 → 6.19.0 and gradio-client 2.3.0 → 2.5.0, adds hf-gradio 0.4.1, and drops aiofiles + ffmpy (the gradio 6.1x dependency reshuffle; all hashes verified; net 142 → 141). gradio is transitive here (qed only declares openenv-core[core]), so lock-only is correct.

[cursor]

Tier 2 (reproducibility) — index-source flip. This whole lock was regenerated against public PyPI: every package's source moves from the internal mirror https://pypi.registries.huggingface.tech/ → https://pypi.org/simple (132 refs) and revision bumps 2 → 3. Artifact URLs stay on files.pythonhosted.org with unchanged hashes, so almost certainly benign, but it changes the env's declared provenance and widens the cross-env split (qed's lock is already on pypi.org/simple). No committed config pins the mirror (it lives only inside uv.lock), so registry choice is a team decision — flagging, not fixing. cc @Darktex (reproducibility principle) / @burtenshaw (dependabot + lock tooling).

Note: the deploy Dockerfile installs via uv sync --frozen, so the base image's uv must support lock revision = 3 (it does, matching the other already-migrated envs).

[cursor]

Security bump — verified. joserfc 1.6.4 → 1.6.8 (transitive via authlib ← fastmcp; not a direct dep, so lock-only is correct). 1.6.4 is affected by CVE-2026-48990 / GHSA-wphv-vfrh-23q5 (RFC7797 b64=false DoS, fixed in 1.6.7); 1.6.8 clears it. Hashes match PyPI (wheel 22fb31a…, sdist 878620c…), not yanked, no open advisories. Only package changed in this env's lock (125 → 125, 0 add/remove).