Delivered: critical AnyIO TLS certificate spoofing fix plus routine dependency maintenance.
Key accomplishments:
- anyio 4.12.1 -> 4.14.2: fixes CVE-2026-63374 (critical, TLS cert spoofing via IDNA 2003 hostname encoding — CVSS4 9.3) and CVE-2026-64847 (medium, process-pool stderr-pipe deadlock).
- starlette >=1.0.1 -> >=1.3.1, python-multipart >=0.0.27 -> >=0.0.31, pydantic-settings 2.13.1 -> 2.14.2: routine Dependabot bumps, each individually CI-verified (test/lint/docker/CodeQL green) before merge.
- No application source code changed; version-pin and lockfile updates only. 1090 tests passing, ruff clean.
See .planning/MILESTONES.md and GHSA-82r6-8w77-94w6 / GHSA-5p39-cfhj-2xmp for advisory details.