Dependency & CVE Sweep

Follow AGENTS.md first. Consolidate a repo's open Dependabot PRs into one clean PR rather than merging many.

Workflow

1. Bump Python deps with uv lock --upgrade-package <name> (targeted) or uv lock --upgrade (full); keep uv.lock committed and --frozen in the build.
2. SHA-pin GitHub Actions (uses: owner/action@<40-char-sha> # vX.Y.Z), never floating tags.
3. Fix CodeQL findings at the cause; for the common py/incomplete-url-substring-sanitization test-assertion false positive, switch to exact-match assertions.
4. Keep the Trivy gate in the ratified 2-step form (severity: CRITICAL,HIGH + ignore-unfixed: true + exit-code: "1") and retain the SBOM (../genefoundry-router/docs/CONTAINER-HARDENING-STANDARD-v1.md).
5. Gate on make ci-local; patch-bump the app version; squash-merge only on green.

Gotcha (FastMCP bumps)

When bumping FastMCP, verify validation-error wrapping: some 3.4.x releases re-raise argument-validation errors as fastmcp.exceptions.ValidationError, so a test asserting on a Pydantic ValidationError must walk __cause__. A version/catalog guard test may also need regenerating.

Common mistakes

• Merging Dependabot PRs one-by-one instead of one consolidated PR.
• Floating action tags instead of SHA pins.
• Flipping Trivy exit-code: "1" without ignore-unfixed: true — gates on unfixable base-image CVEs → self-inflicted outage.