Security: refresh dependencies for 0.11.0 rc2

[dubh3124]

Summary

• Resolves the current open Dependabot alert set for the v0.11 release lockfile by refreshing patched Python dependencies.
• Updates the adjacent runtime family, including Deep Agents 0.6.12, LangChain/LangGraph, FastAPI/Starlette, OpenTelemetry, provider adapters, OpenAI, and MLflow deploy dependencies.
• Prepares 0.11.0-rc.2 release metadata.
• Adds a small compatibility fix for the Deep Agents 0.6.12 backend protocol: glob/aglob now accepts path: str | None.

Alerts Covered

• pydantic-settings: GHSA-4xgf-cpjx-pc3j
• langsmith: GHSA-f4xh-w4cj-qxq8
• langchain / langchain-anthropic: GHSA-gr75-jv2w-4656
• starlette: GHSA-82w8-qh3p-5jfq, GHSA-jp82-jpqv-5vv3, GHSA-wqp7-x3pw-xc5r, GHSA-x746-7m8f-x49c, GHSA-86qp-5c8j-p5mr
• cryptography: GHSA-537c-gmf6-5ccf
• aiohttp: GHSA-xcgm-r5h9-7989, GHSA-4m7w-qmgq-4wj5, GHSA-9x8q-7h8h-wcw9, GHSA-4fvr-rgm6-gqmc, GHSA-g3cq-j2xw-wf74, GHSA-63hw-fmq6-xxg2, GHSA-hpj7-wq8m-9hgp, GHSA-2fqr-mr3j-6wp8, GHSA-m6qw-4cw2-hm4m, GHSA-hg6j-4rv6-33pg, GHSA-jg22-mg44-37j8
• python-multipart: GHSA-5rvq-cxj2-64vf, GHSA-v9pg-7xvm-68hf, GHSA-6jv3-5f52-599m, GHSA-vffw-93wf-4j4q
• pyjwt: GHSA-xgmm-8j9v-c9wx, GHSA-993g-76c3-p5m4, GHSA-w7vc-732c-9m39, GHSA-jq35-7prp-9v3f, GHSA-fhv5-28vv-h8m8

Validation

• UV_CACHE_DIR=/tmp/uv-cache uv sync --all-extras --dev — passed
• UV_CACHE_DIR=/tmp/uv-cache uv run pytest tests/unit -q — 784 passed, 4 skipped
• UV_CACHE_DIR=/tmp/uv-cache uv run ruff check . — passed
• UV_CACHE_DIR=/tmp/uv-cache uv run mypy . — passed
• UV_CACHE_DIR=/tmp/uv-cache uv run mkdocs build --strict — passed
• UV_CACHE_DIR=/tmp/uv-cache uv lock --check — passed
• git diff --check — passed

UV_CACHE_DIR=/tmp/uv-cache uv run pytest -q was attempted, but the local run hit broad e2e/scenario failures before reaching the unit suite, consistent with tests that need the full e2e service/container setup. The unit suite above is the dependency-regression gate for this local pass.

Release Plan

After merge, fetch origin/release/v0.11.0, verify the merge commit, create annotated tag v0.11.0-rc.2 on that commit, and push the tag.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
cognition	Ready	Preview, Comment	Jun 26, 2026 4:33pm