[jeffdupont]

What

• Dependency audit in CI: new make audit target that runs pip-audit (pinned 2.9.0) over uv export --frozen of the committed uv.lock, and a Dependency audit CI job that runs it. It audits the lock as committed (no uv lock first), so a vulnerable pin fails the job. It does not block PRs; push to main and a weekly Monday cron fail on it.
• Dependabot: .github/dependabot.yml with uv daily at the workspace root and github-actions weekly (workflows and the composite actions), both with a 7-day cooldown — same shape as go-ai-sdk (go-ai-sdk#3).

CI-only: no uv.lock, source or test changes. The dependency upgrades this PR used to carry are in #257.

Expected failure

The Dependency audit check fails on this PR because it audits main's current lock. That is the job working, and it does not block merge on PRs. It keeps failing on main until #257 lands; with #257's lock, make audit reports no known vulnerabilities.

Verified locally

ruff check, ruff format --check and mypy packages/*/src clean; pytest 3851 passed, 18 skipped on a clean checkout of this branch.

🤖 Generated with Claude Code

---

Note

Overview
Adds automated dependency hygiene: a local make audit target and a matching Dependency audit CI job that scan the committed uv.lock (via frozen uv export + pinned pip-audit@2.9.0) without re-locking first, so known vulnerable pins surface on push to main and on a weekly Monday CI schedule. On pull requests, the audit job is allowed to fail (continue-on-error) so unrelated PRs are not blocked by advisories against the current lock.

Also introduces .github/dependabot.yml to propose daily uv updates at the workspace root and weekly GitHub Actions bumps for workflows and composite actions, each with a 7-day cooldown.

^{Reviewed by Cursor Bugbot for commit ea50e67. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit bcc3de1. Configure here.}

[jeffdupont]

Pushed three commits:

• a52a220 merges origin/main. uv.lock was taken from main and regenerated, not hand-merged. The Makefile .PHONY line keeps both api-report targets and audit.
• 2210f7b runs uv lock -P for brotlicffi, claude-agent-sdk, virtualenv and the OpenTelemetry packages. make audit now reports no known vulnerabilities. Two fixes the upgrade needed:
  • claude-agent-sdk 0.2.173 adds four ClaudeAgentOptions fields. All four go on the excluded list: resume_session_at and resume_drops_turn (session state), forward_subagent_text (stream shape), verbatim_prompts (whether prompt text can make Claude Code read host files).
  • OpenTelemetry 1.45 no longer raises on a malformed OTEL_EXPORTER_OTLP_TIMEOUT, so test_a_failed_telemetry_setup_leaves_no_client_behind now injects the failure itself.
• ce4c397 makes the audit job continue-on-error on pull_request only, and adds a weekly schedule (Mondays 13:00 UTC).

Needs a human reviewer.

🤖 Generated with Claude Code

[jeffdupont]

The dependency upgrades (and the handler and lifecycle-test changes that came with them) moved to #257, so this PR is CI-only now: the audit target, the CI job and Dependabot. The Dependency audit check here is expected to fail until #257 lands, since it audits main's lock.