CM-70014: update dependencies (Aug 2026)

[omer-roth]

Applies the four open Dependabot bumps in one change, plus a lock refresh, and fixes the one real regression they surfaced.

Package	From	To	Constraint
marshmallow	3.26.2	4.0.1	>=4.0.1,<4.1.0 — 4.1+ requires Python >= 3.10
rich	13.9.4	15.0.0	>=15.0.0,<16.0.0
gitpython	3.1.50	3.1.57	floor raised to >=3.1.51
pyinstaller	6.20.0	6.21.0	unchanged

Supersedes #508 (marshmallow), #503 (gitpython), #488 (pyinstaller), #446 (rich).

Lock refresh

poetry update within the existing constraints — no widening. The 7-day cooldown is enforced by the solver (poetry.toml [solver] min-release-age = 7), which correctly held mcp at 1.28.1. No downgrades. poetry lock split several transitives at a python_version < "3.14" boundary so 3.14 gets newer releases while 3.9–3.13 stay put.

marshmallow 4 pulls in a new compiled transitive, backports-datetime-fromisoformat, on Python < 3.11. cp39/cp310 wheels exist for macOS (arm64/x86_64/universal2), manylinux, musllinux and win_amd64, so every CI matrix cell is covered without building from source.

GitPython fix

GitPython only inverts the R flag when diffing the index against HEAD, not against the empty tree. Both pre-commit call sites passed R=True unconditionally, so scanning a repository with no commits yet produced a reversed patch — staged content sent to Cycode as removed lines instead of added lines.

Centralized in get_staged_diff_index() so both call sites get a consistently oriented patch, with the orientation now asserted in tests (the old assertions only checked b_path).

Verification

Python	Result
3.9.25	927 passed, 1 skipped (test_mcp_command.py — MCP requires 3.10+)
3.12.10	962 passed
3.13.13	962 passed, pyinstaller.spec build + cycode-cli version OK
3.14.5	962 passed

ruff check and ruff format --check clean. marshmallow 4 and rich 15 needed no code changes; rich-sensitive paths tests don't cover (typer help/error panels, the CycodeHeading markdown patch, emoji shortcodes, the progress bar's custom task field, export_html/export_svg) were smoke-tested manually.

🤖 Generated with Claude Code

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}