fix(source-code-analysis-worker-template): refresh lock to dreadnode 2.0.51 (ENG-8859)

[briangreunke]

Summary

Refreshes source-code-analysis-worker-template/uv.lock to dreadnode 2.0.51. This clears the Black Duck (Project Davos) critical and high findings that trace to this lock.

Supersedes #160. That PR locks dreadnode 2.0.49, which still resolves litellm 1.84.0 (CVE-2026-40217).

Linear: ENG-8859

Changes

• pyproject.toml: dreadnode>=2.0.15 -> dreadnode>=2.0.51 (R1)
• uv.lock: regenerated with uv lock --upgrade, no hand edits (R2)
• capability.yaml: version: 0.1.0 -> 0.1.1 (R3)

No other files change.

Acceptance evidence

uv export --frozen --no-hashes --all-extras in the template directory:

Package	Before	After	R2 floor
dreadnode	2.0.15	2.0.51	2.0.51
litellm	1.83.0	1.101.3	1.101.3
pyjwt	2.12.1	2.15.1	2.15.1
pillow	11.3.0	12.3.0	12.3.0
aiohttp	3.13.5	3.14.5	3.14.3
urllib3	2.6.3	2.8.0	2.8.0
mcp	1.27.0	1.30.0	1.30.0
starlette	1.0.0	1.3.1	1.3.1
python-multipart	0.0.26	0.0.32	0.0.32
transformers	5.6.2	5.19.0	5.19.0
anyio	4.13.0	4.15.1	4.15.1
cryptography	47.0.0	50.0.2	50.0.2

aiohttp 3.14.3 is the first release that fixes GHSA-cq5v-8q36-5273 (high), which is the most recent aiohttp advisory. No advisory affects 3.14.4 or 3.14.5. aiohttp is a transitive dependency through litellm, so this PR does not add a direct pin.

Also: fastmcp 3.2.4 -> 3.4.8, protobuf -> 7.36.2.

Validation

• uv lock --check: lock is consistent (187 packages)
• uv run --python 3.13 --extra dev pytest: 21 passed (dreadnode 2.0.51 requires Python <3.14)
• just validate strict=true (repo root): 26 validated, 20 ok, 6 warn, 0 failed. The template validates as source-code-analysis-worker-template@0.1.1. The 6 warnings are missing external tools (nuclei, httpx, and others) in other capabilities.

SHAs

• Base: main@563a38f6307b8553d4e5f4ba4e1ccb730ea9f583
• Head: 3a77b2964d924044c843c17d15d2144d560b730d

🤖 Generated with Claude Code

[briangreunke]

Automated agent review (not a human approval)

[REVIEW] — APPROVE

• Base: main@563a38f6307b8553d4e5f4ba4e1ccb730ea9f583
• Head: 3a77b2964d924044c843c17d15d2144d560b730d

No blocking findings.

• Scope: three files, all in ENG-8859 scope (R1-R3).
• Outcome: each flagged package resolves to one version, and each meets or exceeds its R2 floor. aiohttp 3.14.5 is above the patched floor of 3.14.3 (GHSA-cq5v-8q36-5273).
• An OSV batch query over all 186 exported packages finds 0 vulnerabilities.
• uv lock --check passes. All sources point to PyPI.
• Tests: uv run --frozen --python 3.13 --extra dev pytest gives 21 passed.
• just validate strict=true: 0 failed. The 6 warnings are missing external tools in other capabilities.
• CI on head: all 4 checks pass.

Non-blocking: pyproject.toml version stays 0.1.0. #160 bumped it to 0.1.1. R3 names only capability.yaml.

[Copilot]

🟢 Approval recommended

The dependency metadata and lockfile are consistent with the stated security update and validation evidence.

0 open findings

What changed in this PR

Updates the source-code analysis worker template to patched dependencies that address reported vulnerabilities.

Changes:

• Raises the Dreadnode minimum version to 2.0.51.
• Refreshes transitive dependencies in uv.lock.
• Bumps the capability version to 0.1.1.

File	Description
pyproject.toml	Raises the Dreadnode dependency floor.
uv.lock	Locks updated direct and transitive dependencies.
capability.yaml	Bumps the capability patch version.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.