[hellices]

Closes #554

Summary

Combines the three open Dependabot PRs into one. Each bump is cherry-picked unchanged; uv.lock was not re-locked through a mirror (uv lock --no-config --check against PyPI passes).

Supersedes	Change
#551	Runtime: litellm 1.100.4 → 1.100.5, mcp 2.2.0 → 2.3.0, starlette 1.7.0 → 1.10.0, httpx2 2.13.1 → 2.16.0, azure-identity 1.25.3 → 1.27.0
#552	Actions: setup-uv v10.3.3, upload-artifact v7.0.2, codeql-action v4.39.1, download-artifact v8.0.2, setup-python v7.1.0, gh-action-pypi-publish v1.14.3, create-github-app-token v3.3.0
#553	Dev tooling: mkdocs-material 9.8.0, pytest 9.2.0, pytest-asyncio 1.4.1, mypy 2.4.1, ruff 0.17.3, tach 0.35.3, pre-commit 4.7.0, types-regex, hatchling 1.33.0

Adaptations (639952d4) — why each PR was red on its own:

• pytest-asyncio 1.4.1 warns when asyncio_default_fixture_loop_scope is unset; filterwarnings = ["error"] made that an INTERNALERROR (every pytest job, incl. the Kubernetes matrix). Set to "function" — every async fixture is function-scoped, so behaviour is unchanged.
• mkdocs-material 9.8.0 renamed its bundle to bundle.c21346df.min.js, so the reviewed 9.7.7 override stopped applying and the privacy plugin flagged the unpkg Mermaid URL (mkdocs build --strict failed). The override is re-derived from the upstream 9.8.0 bundle with the same two substitutions (unpkg Mermaid / ResizeObserver → the checksum-pinned local vendor copies). Applying those substitutions to upstream 9.7.7 reproduces the old override byte-for-byte; the new file has no unpkg reference. Overridden templates (main.html, partials/copyright.html, sitemap.xml) are unchanged upstream between the two versions.
• Hatchling 1.33.0: scripts/release/build-constraints.{in,txt} synced (hashes from PyPI; dependency set unchanged).
• LiteLLM 1.100.5: current-pin tests and MEASURED_LITELLM_VERSION moved; the device-login discovery tests re-measure on 1.100.5 and pass. Historical v0.6.1/v0.7.0 records in test_release_policy.py are left as-is. Still below the >=1.101.0 Dependabot hold (Track LiteLLM 1.101.0 ReadOnly warning incompatibility #420).
• Actions: reviewed setup-uv / create-github-app-token pins in tests moved; every new SHA was verified against its release tag via the GitHub API.

Verification

• make check (with the locked environment installed) — passed: ruff, mypy, 15571 passed / 41 skipped, tach.
• env -u UV_INDEX -u UV_DEFAULT_INDEX -u UV_INDEX_URL -u UV_EXTRA_INDEX_URL -u UV_FIND_LINKS uv lock --no-config --check — passed.
• mkdocs build --strict not run locally (Material 9.8.0 not yet available on the local mirror); left to the Build the docs site check.

Checklist

• This closes an accepted issue in this repository that is assigned to me.
• Tests cover the change, written to fail first where behavior changed.
• make check passes locally.
• User-facing docs and the README match the change, or nothing user-facing changed.
• No security invariant is weakened: writes still need a keystroke approval
  and a fail-closed audit entry, and sensitive reads are still masked.

[Copilot]

🟢 Approved

No active review issues are reported for the bundled dependency, GitHub Actions, and development-tooling updates.

No open issues 🎉

What changed in this PR

Bundles the runtime, GitHub Actions, and development-tooling Dependabot updates from #551–#553, addressing #554 with the compatibility adjustments needed by korvid’s tests, release builds, and documentation site.

Changes:

• Updates dependency pins and release build constraints, keeping LiteLLM below the existing >=1.101.0 hold.
• Refreshes SHA-pinned GitHub Actions and their test expectations.
• Sets an explicit async fixture loop scope and refreshes the Material bundle override while preserving local vendor assets.

File	Description
tests/​test_release_scripts.py	Updates expected LiteLLM release metadata.
tests/​test_lockfile.py	Updates the measured LiteLLM pin assertion.
tests/​test_homebrew_formula.py	Updates the expected Homebrew App-token action SHA.
tests/​test_docs_workflow.py	Updates the expected setup-uv SHA.
tests/​test_docs_build_config.py	Aligns Material version, bundle path, checksum, and attribute checks.
tests/​providers/​test_device_login_prefixes.py	Updates the measured LiteLLM version.
scripts/​release/​build-constraints.txt	Updates Hatchling’s release constraint and hashes.
scripts/​release/​build-constraints.in	Pins the release build toolchain to Hatchling 1.33.0.
pyproject.toml	Updates dependency pins, async fixture scope, and bundle exclusion.
docs/​assets/​javascripts/​bundle.c21346df.min.js	Refreshes the Material override while retaining local vendor loading.
.github/​workflows/​relock.yml	Updates setup-uv and artifact action pins.
.github/​workflows/​release.yml	Updates release tooling, artifact, publishing, and App-token action pins.
.github/​workflows/​k8s-version-matrix.yml	Updates setup-uv and diagnostics upload pins.
.github/​workflows/​k8s-contract.yml	Updates setup-uv and diagnostics upload pins.
.github/​workflows/​docs.yml	Updates the documentation workflow’s setup-uv pin.
.github/​workflows/​codeql.yml	Updates CodeQL initialization and analysis pins.
.github/​workflows/​ci.yml	Updates setup-uv and Windows artifact upload pins.
.gitattributes	Preserves exact bytes for the renamed Material bundle.

_{Review effort: Balanced}

[my-reviewer-agent]

검토 범위에서 보고할 이슈가 없습니다.

리뷰 범위: 변경사항 일부만 검토했습니다.