fix: resolve backport conflicts and regenerate uv.lock

The automated backport left unresolved conflict markers in pyproject.toml and
uv.lock, which broke TOML parsing and failed every downstream job. The conflict
is resolved in favour of this release branch's own constraint list plus the
single aiohttp>=3.14.3 bump that this backport is for, rather than importing
main's full constraint list, which would pull in unrelated dependency bumps.
The lockfile is regenerated from the resolved pyproject.toml.

Signed-off-by: Charlie Doern <cdoern@redhat.com>

Author: cdoern

pyproject.toml

@@ -8,38 +8,9 @@ fallback_version = "0.4.7"
 [tool.uv]
 required-version = ">=0.7.0"
 constraint-dependencies = [
-<<<<<<< HEAD
+    "aiohttp>=3.14.3",                # CVE-2026-69244: parser DoS
     "pyasn1>=0.6.4",  # CVE-2026-30922, CVE-2026-59885: DoS via unbounded recursion
     "starlette>=1.0.1",                # CVE-2026-48710
-=======
-    "aiohttp>=3.14.3",                # CVE-2026-69244: parser DoS
-    "authlib>=1.6.11",                 # CVE-2026-41425 + 7 more: account takeover, JWE padding oracle, sig bypass
-    "cryptography>=48.0.1",            # CVE-2026-39892: buffer overflow; CVE-2026-34073: DNS constraint bypass
-    "fonttools>=4.60.2",
-    "gitpython>=3.1.47",               # Command injection via Git options bypass
-    "h11>=0.16.0",
-    "idna>=3.15",
-    "joserfc>=1.6.8",
-    "langgraph-checkpoint>=4.1.1",
-    "langgraph-sdk>=0.3.15",
-    "langsmith>=0.8.18",
-    "lxml>=6.1.0",                     # CVE-2026-41066: XML entity expansion with default resolve_entities=True
-    "msgpack>=1.2.1",
-    "pillow>=12.3.0",                  # CVE-2026-42311: PSD RCE; CVE-2026-55379/55380/54060: font/GD DoS
-    "protobuf>=5.29.6",               # CVE-2025-4565 + CVE-2026-0994: parsing vulnerabilities
-    "pyasn1>=0.6.4",                   # CVE-2026-30922: DoS via unbounded recursion
-    "pydantic-settings>=2.14.2",
-    "python-engineio>=4.13.2",
-    "python-multipart>=0.0.31",        # CVE-2026-40347: header injection; CVE-2026-42561: DoS via oversized headers
-    "python-socketio>=5.16.2",         # CVE-2025-61765: RCE via pickle deserialization
-    "requests>=2.34.2",
-    "setuptools<81",                   # milvus-lite imports pkg_resources; setuptools 81+ removes it
-    "starlette>=1.3.1",                # CVE-2026-48710
-    "tornado>=6.5.6",
-    "urllib3>=2.7.0",                  # CVE-2026-44432: DoS via excessive decompression; CVE-2026-44431: cross-origin redirect header leak
-    "transformers>=4.57.2,<5.0.0",     # CVE-2026-1839 fix only in 5.x; ogx doesn't use Trainer; 5.x breaks HybridCache imports
-    "werkzeug>=3.1.6",                 # CVE-2025-66221 + 2 more: safe_join() device name bypass
->>>>>>> 4c34ce13 (fix: bump aiohttp for CVE-2026-69244 (#6375))
 ]
 
 [project]