[glebedel]

Takes Dependabot's grouped bump from #248 (security: pydantic GHSA-qpmf-fgh3-ff25 and GHSA-3r8g-cqwr-jr29, certifi GHSA-6q48-6c7w-9gw2, langsmith advisories via the transitive bump) and adds the code changes it needs to pass CI. ruff 0.17 formats markdown code blocks and ty 0.0.95 reports new diagnostics and exits 1 on warnings, so #248 fails lint and both type checks. openai 3 needs no runtime change: stackone_ai never imports it, and the example only needed typing.

Requested by guillaume@stackone.com via s2d2 Security Autopilot run sa-2026-11-05-ae4daeb6. Supersedes #248.

Package	Before	After
pydantic	2.12.5	2.14.2
openai (examples extra)	2.32.0	3.42.1
langchain-core / langchain / langchain-openai	1.6.3 / 1.4.1 / 1.1.14	1.7.3 / 1.4.7 / 1.7.3
ruff	0.14.10	0.17.3
ty	0.0.7	0.0.95
pytest / pytest-asyncio / pytest-cov / hypothesis / python-dotenv	as in #248	as in #248

Adaptation (on top of Dependabot's commit)

• ruff format applied to README, MIGRATION, CLAUDE.md and tests/test_end_user_id.py.
• tests/vectors added to ruff extend-exclude: it is vendored byte for byte from sdk-conformance and the conformance job diffs it, so ruff must not rewrite it.
• ty 0.0.95: ty-specific suppression codes in the LangChain adapter, a declared dict[str, Any] for prop in toolset.py, stale unresolved-import ignores removed (mcp is a core dependency), AsyncGenerator for the transport context manager, and list_tools(params=PaginatedRequestParams(...)) instead of the deprecated cursor overload (same request; params exists since well before the mcp>=1.24.3 floor).
• Examples: Any for the OpenAI payload lists, narrow tool_calls to function calls before reading .function, drop two unused ignores.

Local checks (identical commands, Python 3.13, logs kept by s2d2)

Check	main	#248 as is	this PR
uv sync --all-extras --locked	pass	pass	pass
pnpm install --frozen-lockfile	pass	pass	pass
ruff check .	pass	pass	pass
ruff format --check .	pass	fail (5 files)	pass
ty check stackone_ai	pass	fail (4 errors)	pass
ty check examples	pass	fail (4 errors)	pass
pytest	871 passed	871 passed	871 passed
uv build	pass	pass	pass

ty check and pytest also pass on Python 3.11.

Demo: dependency fix, evidence is the local suite.

Gates

• forge: ran: slop meter 0 added comment lines, longest block 0, type escapes 0, copies 0 (before = after); no rewrite needed
• review: ran: /stackone-code-review-security:review (correctness + dependency agents) none above threshold
• codex_review: ran: 1 P1 (ruff reformatted vendored tests/vectors/README.md, would fail conformance diff) fixed by restoring the file and adding ruff extend-exclude
• security_scan: ran: security-reviewer none above threshold; Aikido 16 open critical/high on uv.lock: 4 fixed by this bump (langsmith x3, certifi), 12 not in this group (anyio, mcp, cryptography, dnspython) out of scope
• codex_security: ran: none found (OSV clean for all 23 bumped versions, hashes match PyPI)
• security_review: ran: workspace security-review checklist, no findings; session isolation, DO, webhook and D1 items not applicable to an SDK library

Gates ran on 73af0cc.

🤖 Generated with Claude Code

---

Summary by cubic

Applies Dependabot's grouped security bump (pydantic GHSA-qpmf-fgh3-ff25 and GHSA-3r8g-cqwr-jr29, certifi GHSA-6q48-6c7w-9gw2, langsmith via transitive) and adapts the code so CI passes with the new tool versions. openai 3 needs no runtime change — stackone_ai never imports it, and only the example's typing needed updating.

Dependencies

• pydantic 2.12.5 → 2.14.2, langchain-core/langchain/langchain-openai to 1.7.3/1.4.7/1.7.3, openai 2.32.0 → 3.42.1, ruff 0.14.10 → 0.17.3, ty 0.0.7 → 0.0.95, plus the pytest group.
• Fixes 4 open security findings (3 langsmith, 1 certifi); 12 others in uv.lock are out of scope for this group.

Adaptations

• ruff format applied to markdown docs and one test; tests/vectors added to extend-exclude since it's vendored byte-for-byte from sdk-conformance and CI diffs it.
• ty 0.0.95 fixes: ty-specific suppression codes in the LangChain adapter, removed stale unresolved-import ignores for the mcp core dependency, AsyncGenerator for the transport context manager, and list_tools(params=...) instead of the deprecated cursor overload.
• Examples use Any for OpenAI payload lists and narrow tool_calls to function calls before reading .function.

All 871 tests pass on Python 3.11 and 3.13; local lint, format, and type checks are green.

^{Written for commit 73af0cc. Summary will update on new commits.}