build: bump anyio to 4.15.1 in uv.lock to clear two CVEs

[man8-octoflow]

Summary

Bumps anyio in uv.lock to clear two open security advisories (both transitive, via httpx → httpcore → anyio) and turn the repository's audit CI job green.

Changes

• Run uv lock --upgrade-package anyio: anyio 4.11.0 → 4.15.1 (past the 4.14.2 fix floor for both advisories below).
• sniffio is removed from the lockfile — anyio >=4.13 vendors it and nothing else in the dependency graph requires it standalone.
• typing-extensions gains a marker-split entry (4.16.0 alongside the existing 4.15.0), a resolver-cascade side effect of anyio's own tightened constraint, applied consistently everywhere typing-extensions appears (anyio, mypy, pydantic, pydantic-core, pytest-asyncio, typing-inspection).
• pyproject.toml is untouched — byte-identical to its state before this change. Consumers of this library resolve their own anyio via the existing httpx>=0.27.0 constraint, so no floor is added here; that's a separate decision this PR deliberately does not make.

Testing

• audit job's own commands, before and after, in the worktree:
  • Before (anyio 4.11.0): uvx pip-audit --strict --no-deps --disable-pip --progress-spinner off → 2 known vulnerabilities, exit 1 (anyio 4.11.0 CVE-2026-63374, anyio 4.11.0 CVE-2026-64847).
  • After (anyio 4.15.1): same command → no known vulnerabilities found, exit 0.
• uv run pytest -q → 1450 passed, no failures, including tests/test_transport.py (6 passed), which exercises the async httpx transport path directly — anyio is httpx's async backend, and this bump crosses anyio 4.13's removal of its own sniffio dependency.

Context

Two Dependabot security-update runs for this advisory pair both failed with security_update_not_possible, despite each reporting latest-resolvable-version: 4.14.2 and conflicting-dependencies: [] in their own payload — i.e. Dependabot's own numbers say the fix resolves cleanly, but it declined to open a PR. This PR is that same resolve, run and verified locally. The Dependabot automation defect itself is out of scope here.

Checklist

• uv run ruff check . and uv run ruff format --check . pass
• uv run mypy --strict src passes
• uv run pytest -q passes and coverage stays at or above 90%
• uv run pre-commit run --all-files --hook-stage pre-commit passes
• uv run pre-commit run --all-files --hook-stage pre-push passes
• [~] New public functions, methods, and classes have docstrings — no code changed, lockfile-only
• No real credentials, tokens, or PII are added to the diff
• [~] TODO/FIXME/HACK/XXX markers name an issue — none added

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: man8/targetprocess-py/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: bca98366-8c55-4082-820b-0676d3f54d58

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}