chore: align Flow dependency updates and CI contracts

.github/workflows/ci.yml

@@ -129,7 +129,7 @@ jobs:
 
       - name: Install uv for immutable lock check
         if: needs.scope.outputs.code_changed == 'true'
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           version: "0.12.5"
           enable-cache: false

.github/workflows/release.yml

@@ -81,7 +81,7 @@ jobs:
           python-version: "3.12"
 
       - name: Install exact uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           version: "0.11.29"
 
@@ -450,7 +450,7 @@ jobs:
           python-version: "3.12"
 
       - name: Install exact uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           version: "0.11.29"
 

public-artifacts.json

@@ -93,7 +93,7 @@
     },
     {
       "path": ".github/workflows/ci.yml",
-      "sha256": "50810ca5284b7b108049b18c7b6752d2e7c544dc35f65b3e246ad7fe2f24199a"
+      "sha256": "94ae0b4008bbc2ea38d0a9629e2d778c001ac0710b6187b2163c542faefbd6dc"
     },
     {
       "path": ".github/workflows/citrix-workspace-standin.yml",
@@ -121,7 +121,7 @@
     },
     {
       "path": ".github/workflows/release.yml",
-      "sha256": "2a75f50086116e3e63d3d5b48d322763a5104d589522bd0ec9d1dc8205f8fe94"
+      "sha256": "79848b6aace7a48fe62714f5d8b65a3290ac6775292afe60451c6a124c1cb2f2"
     },
     {
       "path": ".github/workflows/validate-claims.yml",

pyproject.toml

@@ -80,7 +80,7 @@ dev = [
     "openadapt-types>=0.18.0,<0.19.0",
     # Engineering-hygiene gates (lint+format, type-check, coverage). Pinned to
     # majors so CI and local dev run the same checkers.
-    "ruff==0.16.6",
+    "ruff==0.16.7",
     "mypy>=1.11",
     "pytest-cov>=5.0",
     "jsonschema>=4.21",
@@ -162,8 +162,8 @@ service = ["fastapi>=0.110", "uvicorn[standard]>=0.29"]
 service-mlx = [
     "fastapi>=0.110",
     "uvicorn[standard]>=0.29",
-    "mlx-vlm>=0.6.17,<0.7",
-    "transformers>=5.14,<5.17",
+    "mlx-vlm>=0.6.17,<0.8",
+    "transformers>=5.14,<5.18",
     "jinja2>=3.1,<4",
 ]
 # Cross-platform desktop recording on-ramp: convert an openadapt-capture

tests/test_ci_workflow_contract.py

@@ -23,7 +23,7 @@ def test_lint_job_rejects_a_stale_dependency_lock() -> None:
     lint_job = workflow[lint_start:compatibility_start]
 
     assert (
-        "uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d" in lint_job
+        "uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4" in lint_job
     )
     assert 'version: "0.12.5"' in lint_job
     assert "run: uv lock --locked" in lint_job

tests/test_dependency_security.py

@@ -28,8 +28,8 @@ def _locked_version(name: str) -> tuple[int, ...]:
 def test_mlx_research_extra_keeps_transformers_in_patched_range() -> None:
     """Do not reintroduce the three model-loading/Trainer RCE advisories."""
 
-    assert (5, 14) <= _locked_version("transformers") < (5, 17)
-    assert (0, 6, 17) <= _locked_version("mlx-vlm") < (0, 7)
+    assert (5, 14) <= _locked_version("transformers") < (5, 18)
+    assert (0, 6, 17) <= _locked_version("mlx-vlm") < (0, 8)
     assert (3, 1) <= _locked_version("jinja2") < (4,)