ci(dependabot): use uv ecosystem so uv.lock stays in sync

[nanotaboada]

Problem

.github/dependabot.yml declared package-ecosystem: "pip". This project is a
uv project (pyproject.toml + uv.lock). The pip handler bumps the ==
pins in pyproject.toml but never regenerates uv.lock, so the lockfile
drifted behind the manifest (uv lock --check failed) and Dependabot could not
open lockfile security-update PRs.

That left 3 advisories stuck against uv.lock, showing "Dependabot cannot
update to the required version":

Alert	Package	Advisory	Severity
#31	Mako	CVE-2026-41205 — path traversal in TemplateLookup	high
#32	Mako	CVE-2026-44307 — path traversal via backslash URI	high
#29	Pygments	CVE-2026-4539 — ReDoS in GUID matching	low

There is no real dependency conflict — uv resolves the upgrades cleanly.

Changes

• .github/dependabot.yml: package-ecosystem pip → uv (GA since
  2025-03). Keeps pyproject.toml and uv.lock in sync and enables
  lockfile security updates.
• uv.lock: regenerated via
  uv lock --upgrade-package pygments --upgrade-package mako:
  • mako 1.3.10 → 1.4.1
  • pygments 2.19.2 → 2.21.0
  • re-synced alembic, cffi, fastapi, gevent, pytest, sqlalchemy
    entries that had drifted behind pyproject.toml
• CHANGELOG.md: Fixed + new Security entries under [Unreleased].

Verification

• uv lock --check — in sync
• flake8 . / black --check . — pass
• pytest --cov — 25 passed, coverage 97.56%
• docker compose build — ok
• coderabbit review --uncommitted — no findings

Closes the alerts once merged; after this, uv-native Dependabot security
updates handle future uv.lock advisories automatically.

🤖 Generated with Claude Code

---

This change is 

Summary by CodeRabbit

• Security
  • Updated locked dependencies to address reported vulnerabilities in Mako and Pygments.
• Chores
  • Improved automated dependency updates to keep the project’s dependency lockfile synchronized with package configuration.
• Documentation
  • Added changelog entries describing the dependency-management update and security upgrades.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 046af86d-37cc-4a75-b809-aa80830ec4b5

📥 Commits

Reviewing files that changed from the base of the PR and between b9e4eac and e23a748.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock, !**/uv.lock

📒 Files selected for processing (2)

• .github/dependabot.yml
• CHANGELOG.md

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

Walkthrough

Dependabot now uses the uv ecosystem for Python updates. The Unreleased changelog records this change and related uv.lock security upgrades and synchronization updates.

Changes

Dependency management

Layer / File(s)	Summary
uv Dependabot configuration and release notes .github/dependabot.yml, CHANGELOG.md	Dependabot uses uv for Python dependency updates. The changelog records lockfile synchronization and upgrades for Mako, Pygments, and other dependencies.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to e23a7

This change switches dependency updates to the uv ecosystem and refreshes the lockfile so dependency metadata stays synchronized and security updates can be applied. No actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Title check	✅ Passed	The title uses the allowed Conventional Commits prefix ci(dependabot):, is 57 characters long, and clearly describes the Dependabot ecosystem change and its purpose.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/dependabot-uv-ecosystem

• 🛠️ sync documentation
• 🛠️ enforce http error handling
• 🛠️ idiomatic review
• 🛠️ verify api contract

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (b9e4eac) to head (e23a748).

Additional details and impacted files

@@            Coverage Diff            @@
##            master      #634   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            7         7           
  Lines          172       172           
=========================================
  Hits           172       172           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.