chore(deps): bundle Dependabot bumps + clear starlette CVE

requirements-dev.txt

@@ -1,6 +1,6 @@
 -r requirements.txt
-ruff>=0.15.14,<1
+ruff>=0.15.17,<1
 bandit>=1.9.4,<2
-pip-audit>=2.10.0,<3
-pytest>=9.0.3,<10
+pip-audit>=2.10.1,<3
+pytest>=9.1.0,<10
 pytest-asyncio>=1.4.0,<2

requirements.lock

@@ -3,29 +3,29 @@
 #   pip install -r requirements.txt && pip freeze > requirements.lock
 annotated-doc==0.0.4
 annotated-types==0.7.0
-anyio==4.13.0
-certifi==2026.5.20
+anyio==4.14.0
+certifi==2026.6.17
 click==8.4.1
 Deprecated==1.3.1
-fastapi==0.136.3
+fastapi==0.137.2
 h11==0.16.0
 httpcore==1.0.9
 httptools==0.8.0
 httpx==0.28.1
-idna==3.16
+idna==3.18
 limits==5.8.0
 packaging==26.2
 pydantic==2.13.4
 pydantic-settings==2.14.1
 pydantic_core==2.46.4
 python-dotenv==1.2.2
 PyYAML==6.0.3
-redis==7.4.0
-slowapi==0.1.9
-starlette==1.1.0
+redis==7.4.1
+slowapi==0.1.10
+starlette==1.3.1
 typing-inspection==0.4.2
 typing_extensions==4.15.0
-uvicorn==0.48.0
+uvicorn==0.49.0
 uvloop==0.22.1
 watchfiles==1.2.0
 websockets==16.0

requirements.txt

@@ -1,10 +1,10 @@
 fastapi>=0.136.3,<1
-uvicorn[standard]>=0.48.0,<1
+uvicorn[standard]>=0.49.0,<1
 httpx>=0.28.1,<1
 pydantic>=2.13.4,<3
 pydantic-settings>=2.14.1,<3
 slowapi>=0.1.9,<1
 limits[redis]>=5.8.0
 python-dotenv>=1.2.2,<2
 # Transitive (via httpx); pinned to clear CVE-2026-45409
-idna>=3.16,<4
+idna>=3.18,<4

tests/test_estimates_refresh.py

@@ -3,7 +3,6 @@
 import asyncio
 import hashlib
 import importlib
-from unittest.mock import patch
 
 import httpx
 import pytest