build(deps): bump the uv group across 2 directories with 2 updates

[dependabot]

Bumps the uv group with 1 update in the / directory: google-cloud-aiplatform.
Bumps the uv group with 1 update in the /docs/knowledge_prototypes/mcp-servers/mcp_youtube-0.2.0 directory: cryptography.

Updates google-cloud-aiplatform from 1.91.0 to 1.133.0

Release notes

Sourced from google-cloud-aiplatform's releases.

v1.133.0

1.133.0 (2026-01-08)

Features

• Deprecate tuning public preview SDK in favor of tuning SDK (35d362c)
• GenAI SDK client - Enabling Few-shot Prompt Optimization by passing either "OPTIMIZATION_TARGET_FEW_SHOT_RUBRICS" or "OPTIMIZATION_TARGET_FEW_SHOT_TARGET_RESPONSE" to the optimize_prompt method (715cc5b)
• GenAI SDK client(memory): Add enable_third_person_memories (65717fa)
• Support Developer Connect in AE (04f1771)

Bug Fixes

• Add None check for agent_info in evals.py (c8c0f0f)
• GenAI client(evals) - Fix TypeError in _build_generate_content_config (be2eaaa)
• Make project_number to project_id mapping fail-open. (f1c8458)
• Replace asyncio.run with create_task in ADK async thread mains. (83f4076)
• Replace asyncio.run with create_task in ADK async thread mains. (8c876ef)
• Require uri or staging bucket configuration for saving model to Vertex Experiment. (5448f06)
• Return embedding metadata if available (d9c6eb1)
• Update examples_dataframe type to PandasDataFrame in Prompt Optimizer. (a2564cc)

v1.132.0

1.132.0 (2025-12-17)

Features

• Add Lustre support to the Vertex Training Custom Job API (71747e8)

Documentation

• A comment for field restart_job_on_worker_restart in message .google.cloud.aiplatform.v1beta1.Scheduling is changed (71747e8)
• A comment for field timeout in message .google.cloud.aiplatform.v1beta1.Scheduling is changed (71747e8)

v1.131.0

1.131.0 (2025-12-16)

Features

• Allow list of events to be passed to AdkApp.async_stream_query (dd8840a)
• GenAI Client(evals) - Support CustomCodeExecution metric in Vertex Gen AI Eval Service (4114728)
• Updates the ADK template to direct structured JSON logs to standard output. (a65ec29)

Bug Fixes

... (truncated)

Changelog

Sourced from google-cloud-aiplatform's changelog.

1.133.0 (2026-01-08)

Features

• Deprecate tuning public preview SDK in favor of tuning SDK (35d362c)
• GenAI SDK client - Enabling Few-shot Prompt Optimization by passing either "OPTIMIZATION_TARGET_FEW_SHOT_RUBRICS" or "OPTIMIZATION_TARGET_FEW_SHOT_TARGET_RESPONSE" to the optimize_prompt method (715cc5b)
• GenAI SDK client(memory): Add enable_third_person_memories (65717fa)
• Support Developer Connect in AE (04f1771)

Bug Fixes

• Add None check for agent_info in evals.py (c8c0f0f)
• GenAI client(evals) - Fix TypeError in _build_generate_content_config (be2eaaa)
• Make project_number to project_id mapping fail-open. (f1c8458)
• Replace asyncio.run with create_task in ADK async thread mains. (83f4076)
• Replace asyncio.run with create_task in ADK async thread mains. (8c876ef)
• Require uri or staging bucket configuration for saving model to Vertex Experiment. (5448f06)
• Return embedding metadata if available (d9c6eb1)
• Update examples_dataframe type to PandasDataFrame in Prompt Optimizer. (a2564cc)

1.132.0 (2025-12-17)

Features

• Add Lustre support to the Vertex Training Custom Job API (71747e8)
• Add Lustre support to the Vertex Training Custom Job API (71747e8)

Documentation

• A comment for field restart_job_on_worker_restart in message .google.cloud.aiplatform.v1beta1.Scheduling is changed (71747e8)
• A comment for field timeout in message .google.cloud.aiplatform.v1beta1.Scheduling is changed (71747e8)

1.131.0 (2025-12-16)

Features

• Allow list of events to be passed to AdkApp.async_stream_query (dd8840a)
• GenAI Client(evals) - Support CustomCodeExecution metric in Vertex Gen AI Eval Service (4114728)
• Updates the ADK template to direct structured JSON logs to standard output. (a65ec29)

Bug Fixes

• Fix RagManagedVertexVectorSearch when using backend_config (df0976e)
• GenAI Client(evals) - patch for vulnerability in visualization (8a00d43)

... (truncated)

Commits

• 78f2bdd chore(main): release 1.133.0 (#6211)
• c8c0f0f fix: Add None check for agent_info in evals.py
• 9952b97 chore: rollback
• 83f4076 fix: Replace asyncio.run with create_task in ADK async thread mains.
• 937d5af Copybara import of the project:
• aaaf902 chore: bump google-auth lower bound to 2.47.0 in GenAI and Vertex SDKs
• 8c876ef fix: Replace asyncio.run with create_task in ADK async thread mains.
• 5448f06 fix: Require uri or staging bucket configuration for saving model to Vertex E...
• 65717fa feat: GenAI SDK client(memory): Add enable_third_person_memories
• be2eaaa fix: GenAI client(evals) - Fix TypeError in _build_generate_content_config
• Additional commits viewable in compare view

Updates cryptography from 48.0.0 to 50.0.0

Changelog

Sourced from cryptography's changelog.

50.0.0 - 2026-07-31

* **SECURITY ISSUE**:
  :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`
  and its PEM and S/MIME variants no longer expose distinguishable errors or
  timing when unwrapping a ``RecipientInfo``'s ``encryptedKey``, which could
  act as a Bleichenbacher oracle for callers that decrypt untrusted messages.
  A random key is now substituted on failure, as described in :rfc:`3218`.
  Credit to **@X1AOxiang** for reporting the issue. **CVE-2026-69247**
* Deprecated Diffie-Hellman key exchange over finite fields (FFDH).
  Everything FFDH is deprecated, including the types in
  ``cryptography.hazmat.primitives.asymmetric.dh`` and loading FFDH keys or
  parameters with the key loading APIs. Users should migrate to a more
  modern key exchange algorithm.
* Added ``xof()`` class methods to
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE256` for constructing
  algorithm instances configured for use with
  :class:`~cryptography.hazmat.primitives.hashes.XOFHash`.
* The :mod:`X.509 verification <cryptography.x509.verification>` APIs are now
  considered stable and are subject to our API stability policy.
* Added the :doc:`/cobblestone` recipe, an implementation of the
  Cobblestone-128 and Cobblestone-256 instantiations of the `C2SP
  chunked-encryption specification
  <https://c2sp.org/chunked-encryption>`_ for streaming authenticated
  encryption of large messages.
* Parsing a Signed Certificate Timestamp list now rejects encodings that
  carry trailing bytes after the list or after an individual SCT, instead of
  silently ignoring them.
* Added support for using :class:`~cryptography.x509.Name` as a field type in
  the :doc:`/hazmat/asn1/index` module.
* Loading a public key or an EC private key now rejects DER where the
  ``subjectPublicKey`` (or EC ``publicKey``) ``BIT STRING`` declares a non-zero
  number of unused bits, instead of silently ignoring it.
* Parsing a CRL entry's ``InvalidityDate`` extension now rejects a
  ``GeneralizedTime`` that carries fractional seconds or another non-DER form,
  matching the strict encoding already required for every other X.509 time
  field.
* :func:`~cryptography.x509.ocsp.load_der_ocsp_request` and
  :func:`~cryptography.x509.ocsp.load_der_ocsp_response` now reject a request
  or response whose ``version`` field is not ``v1``, the only version defined
  by RFC 6960, matching the version validation already performed when loading
  certificates, CSRs and CRLs.
* :class:`~cryptography.hazmat.primitives.hashes.XOFHash` is now supported
  when building against AWS-LC.
* HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when
  building against AWS-LC.
* Diffie-Hellman (:doc:`/hazmat/primitives/asymmetric/dh`) is now supported
  when building against AWS-LC.
</tr></table> 

... (truncated)

Commits

• dcb7050 Prepare for 50.0.0 release (#15372)
• 53fccd9 Don't leak how PKCS#7 encryptedKey decryption failed (#15369)
• d472f97 Add from __future__ import annotations to all src/ Python files (#15371)
• 908773d Bump downstream dependencies in CI (#15368)
• 2cc07cc Bump BoringSSL, OpenSSL, AWS-LC in CI (#15367)
• c94ede9 chore(deps): bump ruff from 0.16.0 to 0.16.1 (#15366)
• 67a8308 chore(deps): bump virtualenv from 21.7.0 to 21.7.1 (#15365)
• 95018ff Release the GIL in one-shot AEAD encrypt/decrypt (#15361)
• 6954733 Release the GIL during DH and DSA parameter generation (#15364)
• 6893b94 Import _serialization instead of serialization in x509/extensions (#15363)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
v0-uvai	Ready	Preview, v0	Aug 4, 2026 6:05am

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 3 package(s) with unknown licenses.

See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 59d6181.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

requirements.txt

Package	Version	License	Issue Type
google-cloud-aiplatform	>= 1.133.0	Null	Unknown License

uv.lock

Package	Version	License	Issue Type
google-genai	1.75.0	Null	Unknown License
locust	2.46.0	Null	Unknown License

Allowed Licenses:

MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, Python-2.0, BlueOak-1.0.0, MPL-2.0, CC0-1.0, 0BSD

Excluded from license check:

pkg:npm/caniuse-lite, pkg:npm/@sentry/nextjs, pkg:npm/@sentry/cli, pkg:npm/@sentry/cli-darwin, pkg:npm/@sentry/cli-linux-arm, pkg:npm/@sentry/cli-linux-arm64, pkg:npm/@sentry/cli-linux-i686, pkg:npm/@sentry/cli-linux-x64, pkg:npm/@sentry/cli-win32-arm64, pkg:npm/@sentry/cli-win32-i686, pkg:npm/@sentry/cli-win32-x64, pkg:npm/@sentry/bundler-plugin-core, pkg:npm/@sentry/babel-plugin-component-annotate

OpenSSF Scorecard

Package	Version	Score	Details
pip/cryptography	50.0.0	Unknown	Unknown
pip/google-cloud-aiplatform	>= 1.133.0	Unknown	Unknown
pip/google-cloud-aiplatform	1.133.0	🟢 6	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Code-Review ⚠️ 0 Found 2/28 approved changesets -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Security-Policy 🟢 10 security policy file detected License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Fuzzing ⚠️ 0 project is not fuzzed SAST 🟢 10 SAST tool is run on all commits
pip/google-genai	1.75.0	Unknown	Unknown
pip/locust	2.46.0	Unknown	Unknown

Scanned Files

• docs/knowledge_prototypes/mcp-servers/mcp_youtube-0.2.0/uv.lock
• requirements.txt
• uv.lock

[github-actions]

Agent Completion Truth Gate: NOT_APPLICABLE

Evidence agrees.

Machine-readable verdict

{
  "details": {},
  "reasons": [],
  "verdict": "not_applicable"
}

Workflow evidence

[groupthinking]

Remediation scan — terminal state: HALTED(awaiting_merge_approval)

Automated PR runbook pass on head 59d6181. The diff is safe and functionally green; the only red checks are governance/maintenance, not code.

What the bump does — pure manifest/lockfile change (4 files: pyproject.toml, requirements.txt, two uv.lock), no source edits:

• cryptography 48.0.0 → 50.0.0 (picks up the PKCS#7 Bleichenbacher-oracle fix, CVE-2026-69247).
• google-cloud-aiplatform 1.91.0 → 1.133.0.

Breakage-risk assessment (both are major-ish jumps, so I checked the actual usage):

• cryptography: this repo uses it only for EC sign/verify (ec.ECDSA(SHA256), SECP256R1, load_pem_private_key/load_pem_public_key in src/uvai/security_protocol/*). cryptography 50's breaking changes are confined to FFDH deprecation and stricter X.509/PKCS7/OCSP parsing — none of which this code touches. No breakage expected.
• google-cloud-aiplatform: exercised by test_vertex_ai_agent.py etc. — the functional CI workflow passed on this SHA, so the jump doesn't break the suite.

Check status on 59d6181: CI ✅ · Security Scan ✅ · Secret Scan ✅ · CodeQL ✅ · Dependency Review ✅ (0 vulnerable / 0 license-incompatible) · Vercel ✅ · truth-gate ✅ (not_applicable) · Coverage (informational, in progress) · E2E/Dependabot Auto Merge skipped.

Why HALTED (not merged): base main is protected, this PR requests review from @groupthinking, and both are major-version bumps with no automerge label — so per policy this needs a human to merge; I did not auto-merge.

One blocker to clear first: the PR Governance check is red because Dependabot's PR body can't satisfy the repo's "Canonical delivery contract" template (## Canonical issue / Outcome / Risk / Verification / Production evidence + exactly one Closes #<issue>). That gate is structurally inapplicable to a bot dependency PR, and I won't fabricate a canonical issue to satisfy it. Recommend either (a) exempting bot actors (dependabot[bot]) in the governance workflow, or (b) an admin/maintainer merge that bypasses it. (branch-cleanup.yml is also red — an unrelated repo-wide maintenance workflow, not caused by this diff.)

Staged next step (human): once governance is exempted/bypassed, comment ·@·d·ependabot m·erge or squash-merge from the UI.

---

Generated by Claude Code

[groupthinking]

Review — dependency bump assessment (automated shepherd)

Verdict: safe on content; the only blocker is the PR Governance contract, which is a human gate.

Scope — pure dependency/lockfile change, 4 files, no source edits:

• pyproject.toml / requirements.txt: floor raise google-cloud-aiplatform>=1.38.0 → >=1.133.0 (uv.lock resolves 1.133.0).
• docs/knowledge_prototypes/mcp-servers/mcp_youtube-0.2.0/uv.lock: cryptography 48.0.0 → 50.0.0, which pulls in the fix for CVE-2026-69247 (PKCS#7 encryptedKey Bleichenbacher oracle). Net security positive, and confined to the docs prototype lockfile — so cryptography 50's breaking changes (FFDH deprecation, stricter DER parsing) don't touch the main app.

Compatibility — the codebase's google-cloud-aiplatform usage is limited to stable surfaces: vertexai.generative_models (GenerativeModel/Part/Content), vertexai.preview.reasoning_engines, vertexai.language_models.TextEmbeddingModel, and top-level aiplatform (all import-guarded). None touch the tuning public-preview SDK deprecated in 1.133, so the floor raise is compatible.

CI (head 59d6181) — substantive checks green: test, build, lint-python, lint-frontend, dependency-review (0 vulnerable / 0 license conflicts; 3 "unknown license" are metadata gaps on known Apache/MIT projects), bandit, trivy, CodeQL, python-safety, npm-audit, PostgreSQL migration matrix, and truth-gate. Generate and Upload Coverage is non-gating.

Blocker (1): PR Governance = failure. That gate (.github/workflows/pr-governance.yml) requires the PR body to contain ## Canonical issue, ## Outcome, ## Risk, ## Verification, ## Production evidence, plus exactly one Closes #<issue>. Dependabot's body has none of these — this is a deliberate human-authored-intent gate, not a defect in the bump. I've intentionally not edited Dependabot's body or created a canonical issue to satisfy it, since that would both defeat the gate's purpose and stop Dependabot's automatic rebase/conflict resolution.

To land it, a maintainer should either (a) fill in the governance sections + link a canonical issue on the PR body, or (b) merge via policy/admin override:

gh pr merge 1359 --repo groupthinking/EventRelay --squash

Terminal state: HALTED(awaiting_governance_contract + merge_approval).

---

Generated by Claude Code

[groupthinking]

Automated review — ready for your merge decision

Scope: dependency-metadata only — uv.lock, pyproject.toml (+2/-2), requirements.txt (+1/-1), and a nested mcp_youtube-0.2.0/uv.lock. No source code changed.

Upgrades:

• cryptography 48.0.0 → 50.0.0 (2 majors) — includes security fix CVE-2026-69247 (PKCS#7 Bleichenbacher-oracle hardening). Also deprecates FFDH and tightens X.509/DER parsing.
• google-cloud-aiplatform 1.91.0 → 1.133.0 (42 minors).

Risk assessment: Low for this codebase. The only cryptography usage here is EC (SECP256R1/ECDSA-SHA256) signing/verification and PEM key load/serialize in src/uvai/security_protocol/* — none of the 50.0 breaking surface (no asymmetric.dh/FFDH, no PKCS#7, and self-generated well-formed PEM keys are unaffected by the stricter DER parsing). The aiplatform jump touches vertex_ai_agent.py/gemini_service.py, and the full test suite passed with both new versions installed.

CI (head 59d6181): ✅ test, build, lint-python, Coverage, PostgreSQL migration matrix (fresh/from-002/round-trip), CodeQL, bandit, python-safety, dependency-review, trivy, Security Scan (py+js), gitleaks, agent-completion/truth-gate. ⚠️ PR Governance failed and Trivy/Agent completion enforcement are neutral — all non-required (mergeable_state: unstable, not blocked), and expected for a Dependabot PR. No merge conflicts.

Recommendation: Green and low-risk; the CVE fix is a reason to merge promptly. Held for human sign-off because main is protected and this PR carries no automerge label — I did not auto-merge. When you're ready: squash-merge, or comment ·@·d·ependabot m·erge.

---

Generated by Claude Code