security: fix 10 open CVEs and repair malformed pyproject.toml

[ry-ops]

Summary

• Repairs pyproject.toml: 6 dependency lines had invalid version specifiers ("httpx>=">=0.28.1") injected by a prior automated fix, leaving the manifest unparseable.
• Bumps every package with an open Dependabot alert to the patched version.
• Regenerates uv.lock against Python 3.12.

CVEs closed (10 open alerts)

Package	Old constraint	New constraint	Resolves
urllib3	>=2.5.0 (broken)	>=2.7.0	CVE-2026-44431, CVE-2026-44432 (HIGH)
python-multipart	>=0.0.26 (broken)	>=0.0.27	CVE-2026-42561 (HIGH), CVE-2026-40347 (MED)
cryptography	>=46.0.6 (broken)	>=46.0.7	CVE-2026-39892 (MED), CVE-2026-34073 (LOW)
requests	>=2.33.0 (broken)	>=2.33.0	CVE-2026-25645 (MED)
python-dotenv	>=1.2.2 (broken)	>=1.2.2	CVE-2026-28684 (MED)
Pygments	>=2.20.0 (broken)	>=2.20.0	CVE-2026-4539 (LOW)
idna	(transitive)	>=3.15 (new direct)	CVE-2026-45409 (MED)
httpx	>=0.28.1 (broken)	>=0.28.1	(syntax fix only)

Resolved versions (uv.lock)

cryptography 48.0.0, idna 3.16, urllib3 2.7.0, requests 2.34.2, python-multipart 0.0.29, pygments 2.20.0, python-dotenv 1.2.2, mcp 1.26.0, starlette 0.52.1, h11 0.16.0, httpx 0.28.1.

Supersedes

• [git-steer] Security: Fix 6 CVE(s) #27, [git-steer] Security: Fix 6 CVE(s) #28, [git-steer] Security: Fix 6 CVE(s) #29, [git-steer] Security: Fix 6 CVE(s) #30 — four duplicate git-steer PRs that only modified SECURITY_FIXES.md; closed
• Security: pin actions/checkout to SHA and bump vulnerable Python deps #13 — Copilot PR whose body described Python dep changes but whose diff only touched .github/workflows/*.yml; closed
• [git-steer] Security: Fix 5 CVE(s) #24 — narrower git-steer PR covering only 5 of the 10 CVEs

After merge, Dependabot's individual-dep PRs (#14, #16, #17, #18, #19) should auto-close once main carries the fixed versions.

Test plan

• CI passes (TOML now actually parses)
• uv sync resolves against the new lock
• No new Dependabot alerts surface against the bumped versions

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Version bumped to 0.1.2.
  • Updated dependency versions to ensure compatibility and stability, including security-related packages.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: f6442e5b-c3ba-458d-b37f-0ce2c8344da8

📥 Commits

Reviewing files that changed from the base of the PR and between 8dcba01 and 6be0910.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• pyproject.toml

---

📝 Walkthrough

Walkthrough

Project version incremented to 0.1.2 and dependency version constraints updated: urllib3 raised to >=2.7.0, cryptography to >=46.0.7, python-dotenv to >=1.2.2, python-multipart to >=0.0.27, with expanded explicit dependency entries for consistency.

Changes

Dependency Update

Layer / File(s)	Summary
Project metadata and dependency constraints pyproject.toml	Version bumped to 0.1.2 and dependency block rewritten with updated >= minimum version requirements for urllib3, cryptography, python-dotenv, python-multipart, and consolidated list including idna, Pygments, h11, mcp, requests, starlette, and httpx.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related issues

• ry-ops/unifi-mcp-server#8: Both changes target the same dependency version constraints (urllib3, starlette, requests, h11, mcp, etc.) in project metadata to address/security-bump vulnerabilities.

Possibly related PRs

• ry-ops/unifi-mcp-server#20: The PR's pyproject.toml dependency bumps align with CVE-targeted upgrade versions documented in SECURITY_FIXES.md.
• ry-ops/unifi-mcp-server#25: Both PRs modify pyproject.toml dependency constraints with matching package version updates (python-dotenv>=1.2.2, cryptography>=46.0.7, etc.) for CVE remediation.

Poem

🐰 A version bump, so neat and bright,
Dependencies dance to safer heights,
Constraints tighten, vulnerabilities take flight—
One small change makes the whole system right! ✨

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch security/fix-cves-and-repair-pyproject

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}