fix: fixed vulnerabilties that appeared in Docker Scout BED-8770

[ktstrader]

Description

Bumps transitive Python deps in uv.lock to clear all fixable HIGH vulnerabilities flagged by Docker Scout in the openhound images. No pyproject.toml changes.

Motivation

Resolves: BED-8770

Fixes

Package	Before → After	Fixes
cryptography	49.0.0 → 50.0.0	CVE-2026-69247
gitpython	3.1.57 → 3.1.59	5 GHSA advisories (arg/config injection, path traversal)
pymdown-extensions	10.21.3 → 11.0.1	CVE-2026-67422 (ReDoS)
urllib3	2.6.3 → 2.7.0	CVE-2026-44431 / 44432
marimo (dev only)	0.23.5 → 0.24.0	unblocks pymdown-extensions >= 11

Verification

• Rebuilt both cli and enterprise targets → Docker Scout: 0C / 0H / 0M / 0L.
• uv lock --check → exit 0.
• Tests: 94 passed, 6 failed (pre-existing, unrelated to these bumps).

0.3.0 / 0.3.0-enterprise on Docker Hub stay vulnerable until rebuilt and pushed from this lockfile.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 34fe4c21-da9c-4e3e-824b-678777b1af16

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}