[peterfoldes]

Summary

Refreshes uv.lock (uv lock --upgrade) and clears every open Dependabot alert on the repo: 35 total (19 high / 12 medium / 4 low → 0), verified locally by comparing each locked version against the alert's first patched version.

Two runtime floors in pyproject.toml go up, because both are security floors on code paths the driver actually exercises with untrusted input:

Dependency	Old floor	New floor	Why
cbor2	>=5.6.3	>=5.9.0	Unbounded recursion in cbor2.loads, which the driver calls on every frame received from the server
sqlparse	>=0.5.0	>=0.6.0	Several CPU-exhaustion / ReDoS bugs reachable through sqlparse.parse, which the driver runs over caller-supplied SQL for log redaction

Library users will notice this: installing the next release requires cbor2>=5.9.0 and sqlparse>=0.6.0. No package version bump here.

Alerts cleared (by package)

Package	Alerts	Locked before	Locked after	Scope
virtualenv	19 (10 high, 6 medium, 3 low)	20.36.1	21.15.1	dev (via pre-commit)
urllib3	5 (4 high, 1 medium)	2.6.3	2.8.0	transitive (requests)
sqlparse	5 (3 high, 2 medium)	0.5.5	0.6.0	runtime, floor raised
pyarrow	1 high	23.0.0	25.0.1 (py3.10) / 26.0.0 (py3.11+)	runtime, lock only
cbor2	1 high	5.8.0	6.1.5	runtime, floor raised
idna	1 medium	3.11	3.20	transitive
requests	1 medium	2.32.5	2.34.2	runtime, lock only
pytest	1 medium	9.0.2	9.2.0	test/dev
pygments	1 low	2.19.2	2.21.0	dev (via rich/pytest)

Floors deliberately not raised

• pyarrow (stays >=14.0.2): the advisory is a use-after-free when reading an IPC file with pre-buffering. The driver only uses the IPC stream reader (pyarrow.ipc.open_stream), and forcing >=23.0.1 would be a heavy constraint for users with pinned Arrow stacks.
• requests (stays >=2.31.0): the advisory is temp-file reuse in extract_zipped_paths(), which the driver doesn't use.
• urllib3 / idna: transitive only; users get them via requests.

Other notable upgrades

Majors in the lock: cbor2 6.x, mypy 2.x (dev), rich 15 (dev), python-dateutil 3.0 (via pandas), websockets 17.3 on py3.11+ (16.1.1 on 3.10). No source changes were needed. The lock file revision goes from 3 to 5 because it was regenerated with a newer uv. CI only uses uv for uv build, which doesn't read the lock.

Follow-up (not in this PR)

websockets ≥ 17.1 emits a DeprecationWarning when websockets.sync.client.connect() isn't used as a context manager, which is how driver.py uses it. Today it's a hidden warning (it fires from library code), but it signals that a future websockets major will change what connect() returns. This exposure already exists for anyone installing websockets 17.x with the current >=13.0 floor; the lock bump just makes it show up in our test run.

Related Issues

Clears all open Dependabot alerts.

---

Requester Checklist

• I have self-reviewed my own code
• I have added/updated tests that prove my fix/feature works (dependency-only; existing suite)
• I have included visual proof (screenshot, video, or test output) if applicable
• All CI checks are passing
• PR size is S/M, OR I have justified the size and added a walkthrough
• I have updated documentation if needed (n/a)

Visual Proof

• uv run pytest tests/ on Python 3.14, 3.12 and 3.10: 315 passed on each.
• The same suite with the new floors pinned (cbor2==5.9.0, sqlparse==0.6.0): 315 passed.
• pre-commit run --all-files: all hooks pass.
• Local alert check (every locked version ≥ the first patched version): before 35 unpatched (19 high / 12 medium / 4 low), after 0.

Size Justification (if L/XL)

Nearly all of the diff is the regenerated uv.lock. The hand-written change is two lines in pyproject.toml.

🤖 Generated with Claude Code

[salty-hambot]

Reviewed by Salty Hambot 🤖🧂 at df9efec

No issues found.
_{💰 $0.1280 · 122.8k in / 2.2k out tokens · ⏱️ 19.6s · us.openai.gpt-6-sol high, prompt coverage-v1
💬 To request a re-review, comment @salty-hambot review}