Security fixes + pip-audit to uv audit migration

[SuaveIV]

Closes 19 open Dependabot alerts (8 high, 9 medium, 2 low).

Vulnerability fixes:

Package	Before	After	Alerts
aiohttp	3.13.2	3.14.3	#73-78 (OOB heap read, HTTP smuggling)
starlette	0.49.1	1.6.0	#33-34, #61-68 (DoS, SSRF, path poisoning)
fastapi	0.122.1	0.141.1	unblocks starlette 1.x
msgpack	1.2.0	removed	#69-70 (transitive via pip-audit)

Also replaces pip-audit with uv audit. uv.lock is now committed and is the single source of truth. requirements.txt and requirements-hashes.txt are exported from it. The justfile lock, audit, and update-deps recipes are rewritten, the CI security workflow runs uv audit + native CycloneDX SBOM export, and uv 0.12.5 is pinned in .mise.toml.

Verification:

• uv audit --locked: no known vulnerabilities (92 packages)
• uv lock --check: passes
• ruff check pyproject.toml: passes
• Full uv sync + familybot imports + StaticFiles all work under starlette 1.6.0

Notes:

• Starlette 0.49 -> 1.6: fastapi 0.141.1 supports this, no breakage.
• routes_common_games.py:48 has a pre-existing regex= deprecation (should be pattern=). Out of scope here, follow-up ticket.
• The VS Code Ruff extension may show false positives on pyproject.toml. CLI ruff check passes.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 5b77fa6d-7fba-40b5-a0fa-9dc9e4bd2b7d

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Supply Chain Security Check Failed

Failed checks:

• Dependency review

Please review the GitHub Actions logs for details and resolve the issues before merging.

[github-actions]

Supply Chain Security Status

Checks Performed:

• uv lock --check (lockfile consistency)
• Hash-pinned lockfile verification
• uv audit against OSV vulnerability database
• CycloneDX SBOM generation

Best Practices:

• Dependencies pinned with hashes in requirements-hashes.txt
• uv.lock committed as single source of truth
• Automated vulnerability scanning on every push/PR

Learn more: https://bernat.tech/posts/securing-python-supply-chain/

[github-actions]

Supply Chain Security Status

Checks Performed:

• uv lock --check (lockfile consistency)
• Hash-pinned lockfile verification
• uv audit against OSV vulnerability database
• CycloneDX SBOM generation

Best Practices:

• Dependencies pinned with hashes in requirements-hashes.txt
• uv.lock committed as single source of truth
• Automated vulnerability scanning on every push/PR

Learn more: https://bernat.tech/posts/securing-python-supply-chain/