security: refresh dependency pins before v1.0 #481

Goal

Clear the actionable dependency security alerts before the v1.0 release without widening or changing the framework's supported runtime contract unintentionally.

Scope

• Update certifi to 2026.10.19 in uv.lock and the hash-locked release toolchain.
• Update opentelemetry-api to 1.45.1 in uv.lock.
• Update setuptools to 84.1.0 in the build and release toolchain pins.
• Investigate the filelock alerts: the first patched release is 4.2.1, which requires Python >=3.11, while base-cli currently supports Python 3.10. Keep this as an explicit compatibility/security disposition; do not silently drop Python 3.10.
• Avoid the broad Dependabot group update because it widens major development/benchmark bounds and is not required for these security fixes.

Acceptance criteria

• The certifi, opentelemetry-api, and setuptools alerts are resolved.
• uv.lock, requirements/release.txt, requirements/release.in, and pyproject.toml remain mutually consistent.
• Full local and hosted validation passes, including security and package gates.
• The filelock disposition is recorded with evidence, including the Python 3.10 support constraint and whether a follow-up is required.

Project fields

• Status: In Progress
• Priority: P1
• Area: Security
• Initiative: v1.0 Readiness
• Size: M