chore(deps): update pydantic requirement from >=2.0.0 to >=2.13.4 #32

	name: Dependency Audit

	on:
	push:
	branches: [main]
	paths:
	- "requirements.txt"
	- "requirements.lock"
	- "pyproject.toml"
	pull_request:
	branches: [main]
	schedule:
	- cron: "0 9 * * 1" # every Monday at 09:00 UTC
	workflow_dispatch:

	# Read-only — this workflow only audits + uploads a report artifact. Note it is
	# also pull_request-triggered, so it MUST stay non-privileged (no secrets, no
	# write perms, no consumption of its artifact by a privileged workflow).
	permissions:
	contents: read

	jobs:
	audit:
	name: pip-audit
	runs-on: ubuntu-latest

	steps:
	- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

	- name: Set up Python
	uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
	with:
	python-version: "3.11"

	- name: Install pip-audit
	run: pip install pip-audit

	- name: Audit core dependencies (hash-verified lockfile)
	# --require-hashes ensures we audit what we actually ship,
	# not a drift from the lockfile.
	run: \|
	pip-audit \
	--requirement requirements.lock \
	--require-hashes \
	--strict \
	--format markdown \
	--output audit-report.md
	continue-on-error: false

	- name: Audit optional extras
	# Audits the broader dependency tree declared in pyproject.toml
	# without requiring hashes (extras are not in the lockfile).
	run: \|
	pip-audit \
	--requirement requirements.txt \
	--strict \
	--format markdown >> audit-report.md
	continue-on-error: false

	- name: Upload audit report
	if: always()
	uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
	with:
	name: audit-report
	path: audit-report.md

Provide feedback