chore(deps): bump dependencies, lock ffi submodule, and expose uv_ffi version

- Locked `uv` submodule to the latest FFI target isolation commit (v0.10.8.post4).
- Added dynamic `__version__` resolution in `uv_ffi/__init__.py` via importlib.
- Bumped `cryptography` (>=46.0.7) and `authlib` (>=1.6.9) to patch recent CVEs for modern Python versions.
- Added explicit dependency tracking notes for Python 3.7 LTS backports.
- Regenerated pip-compile lockfiles.

Modified:
  • src/omnipkg/_vendor/uv_ffi/__init__.py (+6/-0 lines)
  • pyproject.toml (+8/-1 lines)
  • requirements-trace.txt (+7/-5 lines)
  • requirements.txt (+12/-3 lines)

[gitship-generated]

Author: 1minds3t

pyproject.toml

@@ -73,7 +73,7 @@ dependencies = [
     "dataclasses>=0.6; python_version == '3.7'",
 
     # Authlib - version split by Python
-    "authlib>=1.6.5; python_version >= '3.9'",        # Patched for recent CVEs
+    "authlib>=1.6.9; python_version >= '3.9'",        # Patched for recent CVEs
     "authlib>=1.3.2,<1.4.0; python_version == '3.8'", # Max support for 3.8
     "authlib>=1.2.1,<1.3.0; python_version == '3.7'", # Last known stable for 3.7
     # TODO: Create authlib-lts to backport security fixes for Python 3.7-3.8
@@ -84,6 +84,13 @@ dependencies = [
     "aiohttp>=3.10.11,<3.11.0; python_version == '3.8'", # Last Py3.8 version (9 known CVEs)
     "aiohttp>=3.13.5; python_version >= '3.9'",          # Latest with all patches
     #aiohttp-lts on to-do list for pythons 3.7 and 3.8
+
+    # cryptography - version split by Python
+    # Python 3.7: stuck at 45.0.7 (upstream dropped 3.7 before 46.x)
+    # CVEs unresolved: CVE-2026-26007 (HIGH), CVE-2026-34073 (LOW), CVE-2026-39892 (MODERATE)
+    # TODO: cryptography-lts needed for py37 to backport fixes landing in 46.0.5–46.0.7
+    "cryptography>=45.0.7,<46.0; python_version == '3.7'",  # UNSAFE: 3 open CVEs, best available
+    "cryptography>=46.0.7; python_version >= '3.8'",         # fully patched
 
     # Security scanning
     # safety moved to optional 'audit' extra due to CVE-2025-14009 in nltk dependency

requirements-trace.txt

@@ -2,7 +2,7 @@
 # This file is autogenerated by pip-compile with Python 3.11
 # by the following command:
 #
-#    pip-compile --output-file=requirements-trace.txt pyproject.toml
+#    pip-compile --output-file=requirements-trace.txt --strip-extras pyproject.toml
 #
 aiohappyeyeballs==2.6.1
     # via aiohttp
@@ -20,7 +20,7 @@ blinker==1.9.0
     # via flask
 boolean-py==5.0
     # via license-expression
-cachecontrol[filecache]==0.14.4
+cachecontrol==0.14.4
     # via
     #   cachecontrol
     #   pip-audit
@@ -34,8 +34,10 @@ click==8.3.1
     # via
     #   flask
     #   typer
-cryptography==46.0.5
-    # via authlib
+cryptography==46.0.7 ; python_version >= "3.8"
+    # via
+    #   authlib
+    #   omnipkg (pyproject.toml)
 cyclonedx-python-lib==11.7.0
     # via pip-audit
 defusedxml==0.7.1
@@ -138,7 +140,7 @@ urllib3==2.6.3 ; python_version >= "3.10"
     #   requests
 uv==0.10.11 ; python_version >= "3.8"
     # via omnipkg (pyproject.toml)
-uv-ffi==0.10.8.post2 ; python_version >= "3.8" and python_version <= "3.14"
+uv-ffi==0.10.8.post3 ; python_version >= "3.8" and python_version <= "3.14"
     # via omnipkg (pyproject.toml)
 werkzeug==3.1.6 ; python_version >= "3.9"
     # via

requirements.txt

@@ -1,3 +1,9 @@
+#
+# This file is autogenerated by pip-compile with Python 3.11
+# by the following command:
+#
+#    pip-compile --no-annotate --output-file=requirements.txt --strip-extras pyproject.toml
+#
 aiohappyeyeballs==2.6.1
 aiohttp==3.13.5 ; python_version >= "3.9"
 aiosignal==1.4.0
@@ -6,12 +12,12 @@ attrs==25.4.0
 authlib==1.6.9 ; python_version >= "3.9"
 blinker==1.9.0
 boolean-py==5.0
-cachecontrol[filecache]==0.14.4
+cachecontrol==0.14.4
 certifi==2026.2.25
 cffi==2.0.0
 charset-normalizer==3.4.6
 click==8.3.1
-cryptography==46.0.5
+cryptography==46.0.7 ; python_version >= "3.8"
 cyclonedx-python-lib==11.7.0
 defusedxml==0.7.1
 filelock==3.25.2 ; python_version >= "3.10"
@@ -49,6 +55,9 @@ typer==0.24.1
 typing-extensions==4.15.0
 urllib3==2.6.3 ; python_version >= "3.10"
 uv==0.10.11 ; python_version >= "3.8"
-uv-ffi==0.10.8.post2 ; python_version >= "3.8" and python_version <= "3.14"
+uv-ffi==0.10.8.post3 ; python_version >= "3.8" and python_version <= "3.14"
 werkzeug==3.1.6 ; python_version >= "3.9"
 yarl==1.23.0
+
+# The following packages are considered to be unsafe in a requirements file:
+# pip

src/omnipkg/_vendor/uv

@@ -15,6 +15,12 @@ def run(cmd: str) -> tuple:
 
 run_capture = run
 
+try:
+    from importlib.metadata import version as _meta_version
+    __version__ = _meta_version("uv_ffi")
+except Exception:
+    __version__ = "unknown"
+
 # ── Optional exports: present only if the .so was built with them ────────────
 # Imported lazily so that an older .so without these functions doesn't cause
 # an ImportError on the whole module and break FFI availability detection.