[jeffdupont]

What

• Dependency audit in CI: new make audit target that runs pip-audit (pinned 2.9.0) over uv export --frozen of the committed uv.lock, and a Dependency audit CI job that runs it. It audits the lock as committed (no uv lock first), so a vulnerable pin fails the job.
• Dependabot: .github/dependabot.yml with uv daily at the workspace root and github-actions weekly, both with a 7-day cooldown — same shape as go-ai-sdk (go-ai-sdk#3).
• Lockfile upgrades so the new job passes. No pyproject.toml ranges changed:

Package	Was	Now
anyio	4.14.1	4.15.1
langgraph-sdk	0.4.2	0.4.7
mcp	1.28.1	1.30.0
pyjwt	2.13.0	2.15.1
urllib3	2.7.0	2.8.0
virtualenv	21.5.1	21.14.7

These cover all 25 open Dependabot alerts on main (2 critical, 12 high, 11 moderate), plus one mcp advisory (GHSA-84m7-p3x7-pcfv) that pip-audit reports and GitHub doesn't.

Verified locally

• make audit → No known vulnerabilities found
• Control: pip-audit on pyjwt==2.13.0 exits 1 with 14 advisories, so the job fails on a vulnerable pin
• uv lock --check, ruff check, ruff format --check, mypy packages/*/src clean; pytest 2536 passed, 14 skipped

Not verified: the CI run itself (this PR's checks will show it).

🤖 Generated with Claude Code

---

Note

Overview
Adds automated dependency security via a new make audit target (uv export --frozen + pinned pip-audit) and a Dependency audit CI job that runs it against the committed uv.lock without regenerating the lock first, so vulnerable pins fail CI.

Introduces Dependabot for the uv workspace (daily) and GitHub Actions (weekly), each with a 7-day cooldown.

uv.lock is bumped (e.g. urllib3, pyjwt, mcp, anyio, langgraph-sdk, virtualenv) so the new audit job passes; no pyproject.toml version range changes.

^{Reviewed by Cursor Bugbot for commit 91c6752. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit bcc3de1. Configure here.}