Remediate vulnerable transitive Python dependencies in workspace lockfile

[Copilot]

A forked commit identified dependency vulnerabilities worth reviewing upstream. In this repo, the only still-relevant remediation is in the workspace Python lockfile: vulnerable transitive pins for authlib and urllib3.

• Scope

  • Applies the relevant subset of the forked dependency cleanup without changing declared project dependencies or expanding the blast radius.
  • Leaves Rust dependencies untouched because the current Cargo.lock no longer contains the vulnerable openssl entries referenced by the fork commit.

• Lockfile updates

  • Bumps authlib from 1.6.6 to 1.6.9
  • Bumps urllib3 from 2.6.2 to 2.7.0

• Impact

  • Preserves current package surfaces and dependency declarations.
  • Narrows the change to lockfile resolution so functionality remains aligned with the existing dependency set.

# uv.lock
authlib = "1.6.9"
urllib3 = "2.7.0"

[atlassian-cla-bot]

Thank you for your submission! Like many open source projects, we ask that you sign our CLA (Contributor License Agreement) before we can accept your contribution.
If your email is listed below, please ensure that you sign the CLA with the same email address.

The following users still need to sign our CLA:
❌Copilot

_{Already signed the CLA? To re-check, try refreshing the page.}