fix(deps): patch MLflow and GitPython security advisories

[anandpant]

Summary

• Raise the MLflow minimum to 3.16.1 and regenerate its matched MLflow/skinny/tracing lock entries.
• Constrain transitive GitPython to >=3.1.60 and lock the minimal patched 3.1.60 release.
• Leave aiohttp unchanged because Dependabot PR Bump aiohttp from 3.13.4 to 3.14.0 in the uv group across 1 directory #37 already covers it.

Addresses audited package ranges for GHSA-239g-whfq-7xj9, GHSA-284h-m62q-gf8w, GHSA-7gwp-5pfp-969j and GHSA-gqvg-gmmx-x4hm. This is a dependency remediation, not evidence that those vulnerable features are deployed or reachable.

Validation

• uv lock --upgrade-package mlflow==3.16.1 --upgrade-package gitpython==3.1.60: passed; only four package versions changed.
• uv sync --locked --extra dev: passed.
• uv run --locked --extra dev pytest -q: 6 passed, 7 skipped (external-service/API-key dependent checks).
• Foundry OpenAPI generation and validation: passed; checked-in artifact unchanged.
• uv run --locked --extra dev ruff check .: fails on 5 pre-existing findings in untouched source (three B023, UP015, I001).
• Docker image/portability checks not run locally: Docker unavailable in this environment.
• Existing numpy 2.4.0 lock is yanked for a backward-compatibility issue; left outside this security-only change.

Draft for review; no merge or deployment performed.

[railway-app]

🚅 Deployed to the dspy-template-openapi-comp-pr-39 environment in dspy-reference-example

Service	Status	Web	Updated
dspy-reference-examples	✅ Success (View Logs)	Web	Oct 7, 2026 at 5:01 am UTC

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	mlflow@​3.11.1 ⏵ 3.16.1		+75
	gitpython@​3.1.46 ⏵ 3.1.60		+74

View full report