fix(deps): add security floors for vulnerable transitive dependencies

[pkaeding]

Summary

Remediates all open HIGH-severity Dependabot alerts (101 open alerts total; no CRITICAL). Every flagged package is a transitive dependency, and this repo intentionally gitignores poetry.lock, so GitHub's dependency graph resolves each transitive requirement at its declared lower bound (e.g. cryptography >= 0.5.0) rather than at what poetry install actually picks. A fresh poetry lock today already resolves to patched versions everywhere — the alerts persist purely because the declared floors are unpatched.

Fix: declare explicit patched floors for the affected transitive packages in each affected example's pyproject.toml, e.g.

[tool.poetry.dependencies]
...
# Transitive dependency floors required to satisfy security advisories.
cryptography = ">=50.0.0"
langsmith = ">=0.8.18"
mcp = ">=1.28.1,<2.0.0"

mcp carries a <2.0.0 cap because an unbounded floor made the resolver pull mcp 2.0.0 and downgrade openai-agents from 0.1.0 to 0.0.7; with the cap, resolution is byte-for-byte the same set as main (mcp 1.29.0, openai-agents 0.1.0). No existing minimum was lowered — these packages had no explicit constraints before.

Remediated HIGH alerts (by package → floor):

• cryptography → >=50.0.0 (GHSA-g6cj-pr64-35w5, GHSA-jwv3-5hgf-82ww, GHSA-537c-gmf6-5ccf)
• pyasn1 → >=0.6.4 (GHSA-8ppf-4f7h-5ppj, GHSA-hm4w-wwcw-mr6r, GHSA-m4p7-r5rc-7g4j)
• langsmith → >=0.8.18 (GHSA-f4xh-w4cj-qxq8)
• mcp → >=1.28.1 (GHSA-vj7q-gjh5-988w, GHSA-jpw9-pfvf-9f58, GHSA-hvrp-rf83-w775)
• starlette → >=1.3.1 (GHSA-82w8-qh3p-5jfq, GHSA-wqp7-x3pw-xc5r)
• pyjwt → >=2.13.0 (GHSA-xgmm-8j9v-c9wx)
• python-multipart → >=0.0.31 (GHSA-5rvq-cxj2-64vf)

Free MODERATE/LOW pickups from the same floors: GHSA-jq35-7prp-9v3f, GHSA-w7vc-732c-9m39, GHSA-993g-76c3-p5m4, GHSA-fhv5-28vv-h8m8 (pyjwt); GHSA-x746-7m8f-x49c, GHSA-jp82-jpqv-5vv3, GHSA-86qp-5c8j-p5mr (starlette); GHSA-vffw-93wf-4j4q, GHSA-6jv3-5f52-599m, GHSA-v9pg-7xvm-68hf (python-multipart); GHSA-m2h6-j472-rp4c (cryptography).

Not addressed (MODERATE only, out of scope — would need parent SDK bumps): langchain GHSA-gr75-jv2w-4656, langchain-anthropic, langgraph-checkpoint GHSA-fjqc-hq36-qh5p, langgraph-sdk GHSA-w39p-vh2g-g8g5, pydantic-settings GHSA-4xgf-cpjx-pc3j. No HIGH/CRITICAL alert was left unremediated.

Testing

poetry lock + poetry install succeed in all 10 example projects (CI's only check). All floors are Python 3.10-compatible, matching CI's python-version: '3.10'. Verified resolved versions are patched in every generated lockfile.

Link to Devin session: https://app.devin.ai/sessions/028eb17db0e94bdf93786365942bce3a
Requested by: @pkaeding

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring