Review and refresh the Planfile locked dependency graph

[tom-sapletta-com]

Finding

uv lock --upgrade --dry-run on 2026-09-14 proposes updates for Planfile's locked dependency graph, including security- and transport-adjacent packages such as cryptography, httpx/httpx2, fastapi, starlette, and uvicorn.

Plan

1. Review changes in bounded compatibility groups rather than accepting a bulk upgrade blindly.
2. Regenerate uv.lock from the reviewed constraints.
3. Run the complete supported Python test matrix and focused GitHub-sync regressions.
4. Record any required application compatibility changes in the same PR.

Acceptance

The lockfile is current under the repository constraints, tests pass on the supported matrix, and no unreviewed major-version migration is hidden in a maintenance change.

Host-only dependency audit (Python 3.13, 2026-09-15) found a non-hermetic environment: several packages require missing pyserial, and resolver conflicts include browser-use/google-genai/pytest-httpx versus installed httpx, mcp versus pyjwt, and semgrep versus installed rich/mcp. This must not be “fixed” by upgrading the shared host blindly. Use per-project lockfiles or wheelhouses, run pip check inside each protected environment, and make the report identify the owning project before publication.

[tom-sapletta-com]

Audyt i kandydat zmiany wykonane w osobnym worktree na bazie de135c4f95816645bdee701da1156241c2037e52.

• Ograniczona aktualizacja uv.lock: cffi 2.1.0→2.1.1, cryptography 49.0.0→50.0.1, fastapi 0.139.2→0.141.1, starlette 1.3.1→1.6.0, uvicorn 0.51.0→0.53.0, idna 3.18→3.20, urllib3 2.7.0→2.8.0.
• uv lock --check przechodzi.
• uv run --no-sync pytest -p no:wellmanifest_governance -q: 653 passed, 6 skipped, 1 warning.
• Pełna bramka governance blokuje publikację: ticket-082 koliduje z aktywnymi ticket-087 i ticket-132, a zakresy planfile/sync i testów nie są jednoznacznie przypisane do jednego ticketu.

Nie utworzyłem commit/PR, ponieważ obejście tej bramki naruszałoby regułę exact-one-ticket. Diff pozostaje zachowany lokalnie do wznowienia po serializacji lub zatwierdzeniu integracji.