fix(deps): Update urllib3 to 2.6.0 for security fixes

- GHSA-gm62-xv2j-4w53 and GHSA-2xpw-w6gg-jr37
- Fix CompiledStateGraph type annotation (langgraph API change)

pyproject.toml

@@ -36,8 +36,8 @@ dependencies = [
     "langchain-core>=0.3.21,<1.0",
     "langchain-huggingface>=0.1.2,<1.0",
     "langgraph-checkpoint-sqlite>=3.0.0,<4.0",  # 3.0.0 required for GHSA-wwqv-p2pp-99h5 fix
-    # Security: Pin urllib3 to fix GHSA-48p4-8xcf-vxj5 and GHSA-pq67-6m6q-mj2v
-    "urllib3>=2.5.0",
+    # Security: Pin urllib3 to fix GHSA-gm62-xv2j-4w53 and GHSA-2xpw-w6gg-jr37
+    "urllib3>=2.6.0",
 ]
 
 [project.optional-dependencies]

requirements.txt

@@ -42,8 +42,8 @@ langchain-core>=0.3.21,<1.0
 langchain-huggingface>=0.1.2,<1.0
 langgraph-checkpoint-sqlite>=3.0.0,<4.0
 
-# Security: Pin urllib3 to fix GHSA-48p4-8xcf-vxj5 and GHSA-pq67-6m6q-mj2v
-urllib3>=2.5.0
+# Security: Pin urllib3 to fix GHSA-gm62-xv2j-4w53 and GHSA-2xpw-w6gg-jr37
+urllib3>=2.6.0
 
 # Multi-agent orchestration (Advanced mode) - from [magentic] optional
 agent-framework-core==1.0.0b251204

src/agents/graph/workflow.py

@@ -25,7 +25,7 @@ def create_research_graph(
     llm: BaseChatModel | None = None,
     checkpointer: BaseCheckpointSaver[Any] | None = None,
     embedding_service: EmbeddingServiceProtocol | None = None,
-) -> CompiledStateGraph[Any, Any, Any, Any]:
+) -> CompiledStateGraph:
     """Build the research state graph.
 
     Args:

uv.lock

@@ -1169,7 +1169,7 @@ requires-dist = [
     { name = "structlog", specifier = ">=24.1" },
     { name = "tenacity", specifier = ">=8.2" },
     { name = "typer", marker = "extra == 'dev'", specifier = ">=0.9.0" },
-    { name = "urllib3", specifier = ">=2.5.0" },
+    { name = "urllib3", specifier = ">=2.6.0" },
     { name = "xmltodict", specifier = ">=0.13" },
 ]
 provides-extras = ["dev", "magentic", "rag"]
@@ -6175,11 +6175,11 @@ wheels = [
 
 [[package]]
 name = "urllib3"
-version = "2.5.0"
+version = "2.6.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/15/22/9ee70a2574a4f4599c47dd506532914ce044817c7752a79b6a51286319bc/urllib3-2.5.0.tar.gz", hash = "sha256:3fc47733c7e419d4bc3f6b3dc2b4f890bb743906a30d56ba4a5bfa4bbff92760", size = 393185 }
+sdist = { url = "https://files.pythonhosted.org/packages/1c/43/554c2569b62f49350597348fc3ac70f786e3c32e7f19d266e19817812dd3/urllib3-2.6.0.tar.gz", hash = "sha256:cb9bcef5a4b345d5da5d145dc3e30834f58e8018828cbc724d30b4cb7d4d49f1", size = 432585 }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/a7/c2/fe1e52489ae3122415c51f387e221dd0773709bad6c6cdaa599e8a2c5185/urllib3-2.5.0-py3-none-any.whl", hash = "sha256:e6b01673c0fa6a13e374b50871808eb3bf7046c4b125b216f6bf1cc604cff0dc", size = 129795 },
+    { url = "https://files.pythonhosted.org/packages/56/1a/9ffe814d317c5224166b23e7c47f606d6e473712a2fad0f704ea9b99f246/urllib3-2.6.0-py3-none-any.whl", hash = "sha256:c90f7a39f716c572c4e3e58509581ebd83f9b59cced005b7db7ad2d22b0db99f", size = 131083 },
 ]
 
 [[package]]