fix(deps): lock file maintenance

[renovate]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (in timezone Asia/Ho_Chi_Minh)

• Branch creation
  • "before 5am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details

Package	Version	Score	Details
pip/boto3	1.43.96	Unknown	Unknown
pip/botocore	1.43.96	Unknown	Unknown
pip/fastretrieval	1.6.2	Unknown	Unknown
pip/filelock	3.32.7	Unknown	Unknown
pip/gdown	6.3.0	Unknown	Unknown
pip/google-api-core	2.37.0	Unknown	Unknown
pip/httpcore2	2.13.0	Unknown	Unknown
pip/httpx2	2.13.0	Unknown	Unknown
pip/langsmith	0.12.6	Unknown	Unknown
pip/litellm	1.101.0	Unknown	Unknown
pip/n24q02m-web-core	2.7.5	Unknown	Unknown
pip/platformdirs	4.11.9	Unknown	Unknown
pip/playwright	1.63.0	Unknown	Unknown
pip/propcache	0.5.4	Unknown	Unknown
pip/ruff	0.16.8	Unknown	Unknown
pip/sqlalchemy	2.0.54	Unknown	Unknown
pip/ty	0.0.81	Unknown	Unknown
pip/urllib3	2.8.0	Unknown	Unknown
pip/uvicorn	0.53.0	Unknown	Unknown
pip/virtualenv	21.7.10	Unknown	Unknown
pip/yarl	1.25.1	🟢 6.5	Details Check Score Reason Code-Review 🟢 3 Found 1/3 approved changesets -- score normalized to 3 Maintained 🟢 10 30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 1 dependency not pinned by hash detected -- score normalized to 1 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing 🟢 10 project is fuzzed Security-Policy 🟢 10 security policy file detected Packaging 🟢 10 packaging workflow detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches Signed-Releases 🟢 4 3 out of the last 5 releases have a total of 3 signed artifacts.

Scanned Files

• uv.lock

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​vitest@​5.0.0 ⏵ 5.0.1	+1		+1	-1
	npm/​wrangler@​4.131.1 ⏵ 4.133.0				+1
	npm/​@​cloudflare/​workers-types@​5.20260914.1 ⏵ 5.20260917.1	+1		+1	+1
	pypi/​langsmith@​0.12.4 ⏵ 0.12.6	+1
	pypi/​urllib3@​2.7.0 ⏵ 2.8.0
	pypi/​fastretrieval@​1.6.0 ⏵ 1.6.2
	pypi/​boto3@​1.43.93 ⏵ 1.43.96
	pypi/​n24q02m-web-core@​2.7.3 ⏵ 2.7.6
	pypi/​ty@​0.0.80 ⏵ 0.0.81	+1
	pypi/​ruff@​0.16.7 ⏵ 0.16.8

View full report