Refresh locked dependencies; pin setup-uv v10.2.0

.github/workflows/advisory-review-agent.yml

@@ -174,7 +174,7 @@ jobs:
           ref: refs/pull/${{ env.PR_NUMBER }}/head
           path: pr-head
           persist-credentials: false
-      - uses: astral-sh/setup-uv@v10.0.1
+      - uses: astral-sh/setup-uv@v10.2.0
         with:
           enable-cache: true
           cache-dependency-glob: .autoresearch/uv.lock
@@ -300,7 +300,7 @@ jobs:
           ssh-key: ${{ secrets.checkout_ssh_key }}
           path: .autoresearch
           persist-credentials: false
-      - uses: astral-sh/setup-uv@v10.0.1
+      - uses: astral-sh/setup-uv@v10.2.0
         with:
           enable-cache: true
           cache-dependency-glob: .autoresearch/uv.lock

.github/workflows/advisory-review-summarize.yml

@@ -99,7 +99,7 @@ jobs:
           ssh-key: ${{ secrets.checkout_ssh_key }}
           path: .autoresearch
           persist-credentials: false
-      - uses: astral-sh/setup-uv@v10.0.1
+      - uses: astral-sh/setup-uv@v10.2.0
         with:
           enable-cache: true
           cache-dependency-glob: .autoresearch/uv.lock
@@ -211,7 +211,7 @@ jobs:
           ssh-key: ${{ secrets.checkout_ssh_key }}
           path: .autoresearch
           persist-credentials: false
-      - uses: astral-sh/setup-uv@v10.0.1
+      - uses: astral-sh/setup-uv@v10.2.0
         with:
           enable-cache: true
           cache-dependency-glob: .autoresearch/uv.lock

.github/workflows/ci.yml

@@ -24,7 +24,7 @@ jobs:
         with:
           # Full history: gitleaks scans it (this repo handles credentials).
           fetch-depth: 0
-      - uses: astral-sh/setup-uv@v10.0.1
+      - uses: astral-sh/setup-uv@v10.2.0
         with:
           enable-cache: true
       - run: uv sync --locked

.github/workflows/maintenance-agent.yml

@@ -110,7 +110,7 @@ jobs:
           ref: ${{ needs.resolve.outputs.sha }}
           path: tree
           persist-credentials: false
-      - uses: astral-sh/setup-uv@v10.0.1
+      - uses: astral-sh/setup-uv@v10.2.0
         with:
           enable-cache: true
           cache-dependency-glob: .autoresearch/uv.lock
@@ -212,7 +212,7 @@ jobs:
           ref: ${{ inputs.reviewer_ref }}
           path: .autoresearch
           persist-credentials: false
-      - uses: astral-sh/setup-uv@v10.0.1
+      - uses: astral-sh/setup-uv@v10.2.0
         with:
           enable-cache: true
           cache-dependency-glob: .autoresearch/uv.lock
@@ -318,7 +318,7 @@ jobs:
           ref: ${{ inputs.reviewer_ref }}
           path: .autoresearch
           persist-credentials: false
-      - uses: astral-sh/setup-uv@v10.0.1
+      - uses: astral-sh/setup-uv@v10.2.0
         with:
           enable-cache: true
           cache-dependency-glob: .autoresearch/uv.lock

.github/workflows/release.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v7
-      - uses: astral-sh/setup-uv@v10.0.1
+      - uses: astral-sh/setup-uv@v10.2.0
       - run: uv build
       - uses: actions/upload-artifact@v7
         with:

.github/workflows/review-agent.yml

@@ -62,7 +62,7 @@ jobs:
           ref: refs/pull/${{ inputs.pr_number }}/head
           path: pr-head
           persist-credentials: false
-      - uses: astral-sh/setup-uv@v10.0.1
+      - uses: astral-sh/setup-uv@v10.2.0
         with:
           enable-cache: true
           cache-dependency-glob: .autoresearch/uv.lock

.github/workflows/verify-agent.yml

@@ -142,7 +142,7 @@ jobs:
           ref: ${{ github.event.pull_request.base.ref }}
           path: base
           persist-credentials: false
-      - uses: astral-sh/setup-uv@v10.0.1
+      - uses: astral-sh/setup-uv@v10.2.0
         with:
           enable-cache: true
           cache-dependency-glob: kernel/uv.lock
@@ -236,7 +236,7 @@ jobs:
           ssh-key: ${{ secrets.checkout_ssh_key }}
           path: kernel
           persist-credentials: false
-      - uses: astral-sh/setup-uv@v10.0.1
+      - uses: astral-sh/setup-uv@v10.2.0
         with:
           enable-cache: true
           cache-dependency-glob: kernel/uv.lock

CHANGELOG.md

@@ -16,6 +16,10 @@ Versions follow [SemVer](https://semver.org).
 
 ### Changed
 
+- Refreshed locked dependencies to current releases admitted by the existing
+  bounds: cryptography 50.0.1→50.0.2, pydantic 2.13.5→2.14.0 (pydantic-core
+  2.46.5→2.50.0), mypy 2.3.1→2.4.0, ruff 0.16.6→0.17.0, and transitives;
+  workflows pin `astral-sh/setup-uv@v10.2.0` (#337).
 - The review and verify posting CLIs now share one gate for the untrusted
   emitted envelope, so a security fix to the decode/identity/kind checks lands
   in both (#337).