[surlymochan]

pip-audit on the locked dependency set (all extras plus dev and plugins groups) reports 69 advisories across 16 packages. Six of them ship to users through the extras: aiohttp, idna, kafka-python, multidict, urllib3, and setuptools via grpcio-tools.

This updates only poetry.lock; pyproject.toml is unchanged. After it, the only remaining finding is django (13 advisories), which #428 already covers for the 5.2 line. The runtime set (poetry export --all-extras) audits clean.

package	before	after
aiohttp	3.13.5	3.14.5
anyio	4.13.0	4.15.1
idna	3.11	3.20
kafka-python	2.3.1	2.3.2
multidict	6.7.1	6.9.1
pymongo	4.16.0	4.18.3 (py3.10) / 4.19.0
sanic	25.12.0	25.12.1
setuptools	81.0.0	84.0.0
sqlparse	0.5.5	0.6.0
starlette	1.0.0	1.7.0 (py3.10) / 1.8.0
tornado	6.5.5	6.5.10
ujson	5.12.0	6.0.0
urllib3	2.6.3	2.8.0
webob	1.8.9	1.8.11
werkzeug	3.1.8	3.1.9

typing-extensions and yarl moved up as transitive updates. Every chosen version supports Python 3.10 to 3.14.

Two things to note:

• kafka-python stays on 2.x. 2.3.2 has both fixes, and moving to 3.0 is a bigger change that deserves its own test pass against the Kafka reporter and plugin.
• pyramid resolves to 2.0.2 instead of 2.1, because pyramid 2.1 requires setuptools<82 and the setuptools fix is in 82+. pyramid is only in the plugins group.

The django 6.0.4 pin used on Python 3.12+ isn't touched by #428 either, so it may need a follow-up.

Checked locally with poetry check --lock and poetry run pytest tests/unit (136 passed). The plugin tests will run in CI.