deps: bump 9 locked packages — clears all 15 open Dependabot alerts

[silversurfer562]

Lockfile-only security sweep. All 15 open Dependabot alerts are against uv.lock pins (none against pyproject.toml constraints); one uv lock --upgrade-package pass resolves every one at or above its advisory's first patched version:

Package	From → To	Alerts cleared
cryptography	46.0.7 → 50.0.0	#4, #13, #14, #15 (PKCS#7 oracle, path-building DoS, wildcard SAN, bundled OpenSSL)
pyasn1	0.6.3 → 0.6.4	#10, #11, #12 (decoder DoS ×3)
urllib3	2.6.3 → 2.7.0	#1, #2 (cross-origin header leak, decompression bomb)
starlette	1.3.0 → 1.6.0	#5 (form-limit DoS)
mcp	1.27.2 → 1.29.0	#7 (WebSocket Host/Origin validation)
pydantic-settings	2.14.1 → 2.15.0	#6 (secrets_dir symlink escape)
setuptools	81.0.0 → 84.0.0	#9 (sdist exclusion bypass)
idna	3.11 → 3.19	#3 (encode bypass)
torch	2.12.0 → 2.13.0	#8 (jit.script memory corruption, low)

Exposure context: the worst offenders arrive via optional extras (google-genai → gemini/dev/all; claude-agent-sdk → claude; sentence-transformers → transformers/all), so runtime risk was modest — but everything bumps cleanly, so nothing is accepted or dismissed.

Verification: full suite on the new lock: 1109 passed, 2 xfailed (paraphrased info-only), 0 failed.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
attune-rag	Ready	Preview	Aug 18, 2026 11:39pm

[github-actions]

Perf delta — within baseline

Blocking on regression in: keyword_retriever_retrieve.cpu, rag_pipeline_run.cpu. Other metrics are advisory and don't block merge.

Metric	Baseline mean (s)	Current mean (s)	Δ	Threshold (s)	Status
directory_corpus_load.cpu	0.000060	0.000056	-6.7%	0.000089	ok
directory_corpus_load.wall	0.000060	0.000055	-8.3%	0.000089	ok
keyword_retriever_retrieve.cpu	0.005573	0.004155	-25.4%	0.007221	ok
keyword_retriever_retrieve.wall	0.005573	0.004154	-25.5%	0.007219	ok
rag_pipeline_run.cpu	0.000639	0.000720	+12.7%	0.000919	ok
rag_pipeline_run.wall	0.000638	0.000721	+13.0%	0.000918	ok

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!