[CodexVeritas]

Summary

Bumps the package version to 0.3.6 and upgrades vulnerable dependencies in uv.lock to patched releases that have cleared the 7-day exclude-newer cooldown.

Package	From	To	Scope
aiohttp	3.14.3	3.14.5	runtime
certifi	2026.7.22	2026.10.18	runtime
multidict	6.7.1	7.1.0	runtime
pyjwt	2.13.0	2.15.1	runtime (agents extras)
opentelemetry-api	1.44.0	1.45.1	runtime (agents extras)
urllib3	2.7.0	2.8.0	runtime
filelock	3.32.5	4.2.4	dev
jupyterlab	4.6.3	4.6.4	dev
nbconvert	7.17.1	7.17.2	dev
notebook	7.6.2	7.6.3	dev
tornado	6.5.8	6.5.10	dev
virtualenv	21.7.8	21.14.11	dev

yarl and python-discovery moved as required by the upgrades above.

pyproject.toml now allows pillow<14.0.0 (previously <13.0.0, which excluded every patched release). The lower bound is unchanged.

Not fixed yet

• Pillow (lock stays on 12.3.0): every streamlit release that clears the cooldown caps pillow<13. streamlit 1.66.1 (the first to allow pillow<14) clears the cooldown on Oct 28, after which uv lock --upgrade-package streamlit --upgrade-package pillow picks up pillow 13.0.0.
• cryptography (stays on 46.0.6): asknews pins cryptography<46.0.7 through 0.14.7. asknews 0.14.8 relaxes this to <49.0.1 and clears the cooldown on Oct 30. That fixes everything except the PKCS#7 advisory, which needs cryptography 50.

Testing

• uv run pytest code_tests/unit_tests with TZ=UTC: 1032 passed, 141 skipped.
• Pillow 13 release notes list no breaking change affecting this codebase's usage (Image.open, crop, convert("RGB"), save as WEBP/JPEG/PNG).

🤖 Generated with Claude Code