fix(deps): resolve Dependabot vulnerabilities

[dq-ai-dev]

Summary

• refresh the complete dependency lock across all optional extras
• enforce patched-version floors for direct and transitive vulnerable packages
• keep the Anthropic Bedrock request override typed across the httpx to httpx2 transport migration
• resolve all 79 currently reported Dependabot alerts when merged

Verification

• 1,702 tests passed
• Ruff passed
• Pyright passed with 0 errors
• framework and evaluation import smoke tests passed
• symbol and lazy-export checks passed
• Docker configuration validation passed
• uv pip check reports all 159 installed packages compatible
• pip-audit reports no known vulnerabilities

[zhanghanduo]

Thanks for putting together the dependency security refresh. I found one blocking compatibility regression and one coverage gap:

1. Blocking: uv.lock upgrades openai from 2.29.0 to 2.54.0, but the current config/bootstrap path can pass a cached empty api_key directly to AsyncOpenAI. The lint-and-smoke job reproduces this in test_benchmark_session_bootstraps_team_runtime: OpenAIError: Missing credentials (1701 passed, 1 failed). Please either make the runtime compatible with the new SDK (for example, normalize an empty key to None and/or reload config when environment values change) or retain a compatible OpenAI version, then rerun the full suite. A regression test for the cached-empty-key -> env-set-later path would be valuable.

2. Non-blocking coverage: the Anthropic 1.0 / httpx2 Bedrock override has no focused test. Please add a unit test that exercises _prepare_request and verifies that Authorization: Bearer is injected with the locked Anthropic transport.

The branch also currently conflicts with main in uv.lock, so the lock should be regenerated after rebasing and CI rerun.

[dq-ai-dev]

Addressed both review findings in fe1946f:

• OpenAIClient now normalizes an empty API key to None, preserving the OpenAI 2.54 environment fallback when config was cached before OPENAI_API_KEY was set.
• The benchmark bootstrap test now deterministically covers that cached-empty-key ordering.
• Added a focused Anthropic Bedrock test using the locked httpx2 transport and verifying Authorization: Bearer injection.
• Synced the branch after main was merged; the lockfile is consistent.

Verification: 1,703 tests passed; Ruff passed; Pyright passed with 0 errors; both import-smoke stages, symbol closure, and lazy-export checks passed.

[zhanghanduo]

LGTM