[hassiebp]

What does this PR do?

Upgrades two transitive runtime dependencies in uv.lock to versions that fix open security advisories. Only the lockfile changes; pyproject.toml is untouched.

• anyio 4.12.1 → 4.15.1, which includes the 4.14.2 fix. It comes in through httpx. Advisories: GHSA-82r6-8w77-94w6 (critical) and GHSA-5p39-cfhj-2xmp (medium).
• urllib3 2.7.0 → 2.8.0. It comes in through opentelemetry-exporter-otlp-proto-http → opentelemetry-exporter-http-transport[urllib3]. Advisories: GHSA-vxq7-64xx-v4gw, GHSA-8988-9cw3-xx77 (high) and GHSA-gh4c-6fx4-qh6g (medium).

I generated it with uv lock --upgrade-package anyio --upgrade-package urllib3. No other package versions changed.

This bump only protects our dev and CI environments. It does not change the dependency ranges the published package declares.

Type of change

• Bug fix
• New feature
• Breaking change
• Refactor
• Documentation update
• Tooling, CI, or repo maintenance

Verification

uv lock --check                                                   # Resolved 91 packages
uv run --frozen ruff check .                                      # All checks passed!
uv run --frozen ruff format --check .                             # 575 files already formatted
uv run --frozen mypy langfuse --no-error-summary                  # clean
uv run --frozen pytest -n auto --dist worksteal tests/unit        # 917 passed, 2 skipped

I didn't run the e2e and live-provider suites locally; CI runs them on this PR.

Checklist

• I self-reviewed the diff using code_review.md.
• I added or updated tests for behavior changes. (No behavior change.)
• I updated docs, examples, or .env.template if needed. (Not needed.)
• I did not hand-edit generated files; if generated files changed, I used the upstream regeneration path.
• I did not commit secrets or credentials.

  

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-15T06:29:00.242644Z	dcbba39	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

@claude review

[claude]

Claude Code Review

No review was started: this request came from a bot account. Manual reviews can only be requested by someone with write access to this repository. Ask a maintainer to comment @claude review, or have your automation post the comment from a user account with write access.

_{Tip: disable this comment in your organization's Code Review settings.}

[claude]

I reviewed this lockfile bump and didn't find any bugs. It's still worth a quick human look: the lockfile was regenerated with a newer uv than the one CI pins. CI uses uv 0.11.2 in .github/workflows/ci.yml, and this lock moves from revision 3 to revision 5 with placeholder exclude-newer timestamps. Please confirm that the uv sync --locked jobs pass with the pinned version, or bump the pin to match.

What was reviewed:

• The anyio 4.12.1 -> 4.15.1 and urllib3 2.7.0 -> 2.8.0 entries. The URLs, filenames and versions match, and no other packages changed.
• The typing-extensions marker on anyio widening to < '3.15'. typing-extensions is already in the lock, so the 3.13 and 3.14 envs just pull it in as well.
• The rewritten exclude-newer-package block. It has the same 12 packages with span P3D, now sorted, and only the stored timestamps changed to the placeholder.

Extended reasoning...

Only uv.lock changes: two transitive dependencies are bumped for security advisories, and uv's lock format revision moves from 3 to 5, with the absolute exclude-newer timestamps replaced by placeholders. It touches no application code or security-sensitive code paths, and CODEOWNERS covers only .github/, not uv.lock. I deferred instead of approving because every CI job runs uv sync --locked with uv pinned to 0.11.2. The new revision-5 lockfile was produced by a newer uv, and I couldn't run the pinned version here to check that it accepts this lockfile as up to date.