Refresh uv.lock to clear known vulnerabilities

[mahdi-shafiei]

Refresh uv.lock to clear known vulnerabilities

What

Regenerates uv.lock, upgrading only the packages pip-audit reports as vulnerable.
Twenty-two packages move and one is added as a transitive consequence.
pyproject.toml is untouched.

Among them: aiohttp 3.13.5 to 3.14.3, cryptography 46.0.7 to 49.0.0, datasets
4.8.5 to 5.0.1, gitpython 3.1.49 to 3.1.60, jupyter-server 2.17.0 to 2.21.0,
mistune 3.2.0 to 3.3.4, mlflow 3.11.1 to 3.15.2, starlette 1.0.0 to 1.6.0,
tornado 6.5.5 to 6.5.8, urllib3 2.6.3 to 2.7.0.

Why

This lock is the stalest of the four repos and carries the most findings.

Measured against the target commit: 139 findings across 20 packages before,
3 after.

The Security workflow currently reports green, and that reading is misleading. Its
last run on this branch was 2026-07-13; nothing has run since 2026-07-21. The green
badge reflects a workflow that stopped running, not a clean audit. Auditing the
lock as it stands today gives 139 findings, so the next time the weekly cron fires
the workflow turns red without anyone having changed the repository.

Verification

uv lock --check exits 0 against the unchanged pyproject.toml.

What this does not close

Three findings survive:

• cryptography 49.0.0, PYSEC-2026-3552, fixed in 50.0.0. mlflow requires
  cryptography<50, so no lockfile change reaches it.
• setuptools 81.0.0, PYSEC-2026-3447, fixed in 83.0.0. Not diagnosed.

Because the workflow fails on any finding, it will still go red on its next run.
This patch changes 139 to 3 and makes the remainder a small, named set rather than
a wall.

Nothing here touches patches/DiffBio/2026-08-18-001, which edits pyproject.toml
and will invalidate this lock when it lands.