deps: batched major-version updates + pre-commit hook sync

[haasonsaas]

Summary

Consolidates the four major-bump Dependabot PRs into a single batch, each individually vetted against actual usage.

Supersedes

PR	Package	Bump	Risk review
#13	flask-limiter	3.8.0 → 4.1.1	Only uses `Limiter(key_func=..., default_limits=...)` + `get_remote_address` — both stable. Smoke-tested `sms_server` import: clean.
#15	pre-commit	3.8.0 → 4.6.0	Requires Python ≥3.9 (we use 3.11/3.12). Config schema compatible as-is.
#16	rich	13.7.1 → 15.0.0	Only uses `rich.console.Console` + `rich.table.Table` — both stable.
#18	gunicorn	22.0.0 → 25.3.0	Used only via README CLI example (`gunicorn -w 2 ...`); no Python imports.

Those 4 Dependabot PRs will close automatically once this merges.

Bonus fix: `.pre-commit-config.yaml` hook-pin sync

The pre-commit hooks were pinning versions that no longer match the repo's own deps:

Hook	Was	Now
psf/black	24.8.0	26.3.1
ruff-pre-commit	v0.6.3	v0.15.11

Previously, a developer running `pre-commit run` locally would install an older black/ruff than the repo actually uses — producing different output than CI. Fixing this alongside the pre-commit version bump for clean scope.

Verification

• `pytest -q`: 16/16 pass (py3.12)
• `ruff check .`: clean
• `black --check .`: clean
• `from orbit_agent import sms_server`: imports cleanly with Flask-Limiter 4.x
• `.pre-commit-config.yaml` valid YAML
• Lock-drift guard satisfied (all 4 files updated pairwise)
• CI `test (3.11)` + `test (3.12)`

🤖 Generated with Claude Code

[cursor]

PR Summary

Medium Risk
Medium risk because it upgrades major versions of runtime/server dependencies (Flask-Limiter, rich, gunicorn) which may introduce breaking behavior changes despite minimal code churn.

Overview
Batches major-version upgrades across runtime and dev tooling, updating Flask-Limiter to 4.x, rich to 15.x, gunicorn to 25.x, and pre-commit to 4.x in requirements*.txt and corresponding lockfiles.

Also syncs .pre-commit-config.yaml hook revisions so black and ruff installed by pre-commit match the versions used by the project, reducing local/CI formatting drift.

^{Reviewed by Cursor Bugbot for commit a156e34. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pre-commit@​3.8.0 ⏵ 4.6.0	+1
	gunicorn@​22.0.0 ⏵ 25.3.0	-1
	rich@​13.7.1 ⏵ 15.0.0	+1
	flask-limiter@​3.8.0 ⏵ 4.1.1

View full report