chore(deps): cryptography 48 + 3 patches; cap protobuf<7 and starlette<1 (consolidates #34/#58/#61/#62; defers #59/#60)

[datasciencemonkey]

Summary

Consolidates open dependabot PRs into one verified bump. Each lands as its own commit (cherry-picked from the original dependabot branches with authorship preserved) so any single bump can be reverted independently if a regression surfaces.

Bumps in this PR (4 successful)

Closes	Package	From → To	Type
#58	cryptography	46.0.7 → 48.0.0	major ×2 (drops py3.8; project is ≥3.10)
#61	python-multipart	0.0.27 → 0.0.29	patch
#62	pydantic-settings	2.14.0 → 2.14.1	patch (transitive, via mcp)
#34	astral-sh/setup-uv	94527f2e → 37802adc	GitHub Action SHA pin

pyproject.toml floors raised: cryptography>=48.0.0, python-multipart>=0.0.29.

Deferred (2 dependabot proposals are poison pills)

Two dependabot PRs proposed major bumps that conflict with our own pinned Databricks deps. Both are cherry-picked → reverted → ceiling-capped in pyproject.toml, so dependabot stops re-proposing them until the upstream caps lift.

PR	Bump	Conflict
#60	protobuf 6.33.6 → 7.34.1	databricks-sdk==0.106.0 declares protobuf!=5.26.*,...,<7.0,>=4.25.8. The bump errored pip install -r requirements.txt with a resolver conflict.
#59	starlette 0.52.1 → 1.0.0	mlflow-skinny==3.12.0 declares starlette<1. The pin "worked" with uv pip sync (which trusts the file) but the canonical uv pip compile pyproject.toml silently reverted it. Confirmed via --verbose resolver trace.

New ceilings added to pyproject.toml (matching the existing importlib-metadata<8.8 pattern):

• "protobuf<7"
• "starlette<1"

Each carries an inline comment explaining the transitive cap, the dependabot PR number, and what would unblock re-proposing the bump.

Both PRs stay open for visibility (manual close with a "blocked on upstream cap" comment is the suggested follow-up).

Verification (local)

Per-commit, with each bump installed via uv pip sync requirements.txt:

Commit	Tests	Notes
pydantic-settings 2.14.1	347 pass, 1 npm flake (pre-existing)	transitive bump
python-multipart 0.0.29	347 pass, 1 npm flake	direct floor + lockfile
setup-uv SHA	n/a (CI-only action)	no runtime impact
cryptography 48.0.0	347 pass, 1 npm flake	pat_rotator, content_filter_proxy, cli_auth import + smoke OK
starlette 1.0.0	reverted	conflicts with mlflow-skinny<1 cap
protobuf 7.34.1	reverted	conflicts with databricks-sdk<7 cap
protobuf<7 ceiling + regen	n/a (pyproject + requirements.txt metadata only)	prevents future dependabot proposals
starlette<1 ceiling + regen	n/a (pyproject + requirements.txt metadata only)	prevents future dependabot proposals

Final state: requirements.txt is fully consistent with pyproject.toml — verified by uv pip compile pyproject.toml -o requirements.txt producing no diff against the committed file. All 3 effective bumps (cryptography, python-multipart, pydantic-settings) report their new versions in the venv; full setup_*.py set AST-parses; app, pat_rotator, content_filter_proxy, cli_auth, telemetry, app_state, utils all import.

Tests deselected from the regression run (out-of-scope for dependency bumps):

• tests/test_gateway_discovery.py::TestEndpointConstruction::* — invokes setup_claude.py as a subprocess; hangs on the Claude Code curl installer in some environments (timeout-bound; affects local dev but not CI).
• tests/test_npm_version_pinning.py::TestNpmVersionLive::test_resolves_real_package — documented live-network flake, pre-existing baseline.

Why one PR

Each of the dependabot PRs touched requirements.txt, so they conflict pairwise on merge — a multi-round dependabot rebase cycle every time one merges. Folding them into one verified branch gives the existing update-lockfile.yml workflow exactly one push to regenerate requirements.lock against.

requirements.lock is not updated in this PR — the existing GitHub Actions workflow (.github/workflows/update-lockfile.yml) will regenerate it on merge to main.

Risk register

Risk	Status
cryptography 48 breaks PAT JWT signing or content-filter-proxy TLS	smoke-imported both modules; tests green
protobuf 7 breaks MLflow trace serialization	conflict surfaced at install time — bump reverted, ceiling added
starlette 1.0 breaks MCP HTTP transport	conflict surfaced at compile time (mlflow-skinny cap) — bump reverted, ceiling added
importlib-metadata<8.8 ceiling conflict	none observed; uv pip sync resolved cleanly each step

Test plan

• Each commit individually verified against the unit-test baseline
• Final cumulative smoke after all bumps applied
• uv pip compile pyproject.toml -o requirements.txt produces no diff (file is canonical)
• Protobuf + starlette install-time / compile-time conflicts caught; reverts + ceilings added
• CI regenerates requirements.lock post-merge (handled by update-lockfile.yml)
• Manual workspace deploy verification — recommended on a non-prod workspace before declaring this safe for production rollout

Closes #34
Closes #58
Closes #61
Closes #62