chore(deps): weekly dependency update

[github-actions]

Automated weekly dependency update via python scripts/update-matrix-latest.py && uv lock --upgrade.

⚠️ Provider SDK packages changed. A human needs to re-record cassettes locally before merging.

[sourcery-ai]

Hey - I've found 1 issue

Fixed security issues:

• cryptography (link)
• gitpython (link)
• mcp (link)
• pyjwt (link)
• python-multipart (link)
• starlette (link)
• urllib3 (link)

Prompt for AI Agents

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="py/pyproject.toml" line_range="287" />
<code_context>

 [tool.braintrust.matrix.openai]
-latest = "openai==2.33.0"
+latest = "openai==3.3.1"
 "1.92.0" = "openai==1.92.0"
 "1.77.0" = "openai==1.77.0"
</code_context>
<issue_to_address>
**issue (broader_impact):** The latest matrix sessions install the newly pinned SDKs but this PR does not update their cassette recordings, so cassette-backed integration tests continue using recordings produced by the previous SDK versions and either fail on request mismatches or silently stop validating the new SDK behavior.

**Triggers:** When the cassette-backed nox integration sessions are run before a human re-records the cassettes.

**Suggested fix:** Re-record and commit the cassettes for every changed provider latest pin, or do not merge the pin updates until those recordings are available.
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[sourcery-ai]

issue (broader_impact): The latest matrix sessions install the newly pinned SDKs but this PR does not update their cassette recordings, so cassette-backed integration tests continue using recordings produced by the previous SDK versions and either fail on request mismatches or silently stop validating the new SDK behavior.

Triggers: When the cassette-backed nox integration sessions are run before a human re-records the cassettes.

Suggested fix: Re-record and commit the cassettes for every changed provider latest pin, or do not merge the pin updates until those recordings are available.