fix(deps): update dependencies with published security fixes (#3680)
# Summary This continues our work to reduce the SDK’s dependency surface and keep dependencies on releases with published security fixes. - Update jiter and exclude affected Pydantic releases while retaining Pydantic 1.x and 2.x support. - Retain security floors for the development-only Azure authentication and test updates already merged in #3676, and update the isolated wheel-test pins. Bump Hatchling to 1.27 so the patched Pygments release can still build from source. - Keep the eight-day policy and existing package count unchanged. Add an offline regression test and contributor guidance to prevent private registry URLs from entering the public lockfile. The development lockfile bumps landed in #3676 while this PR was in flight. After merging current main, only jiter and Hatchling change versions here; none of the newly landed fixes is downgraded. The root lock has 74 package names and 76 exact versions, with no active reviewed Python advisory matches. Separate native-dependency findings in Pydantic remain follow-up work pending a compatible stable upstream release. <details> <summary>Published advisories covered by the updates and retained security floors</summary> - Pydantic’s supported version range: [GHSA-mr82-8j83-vxmv](https://github.com/advisories/GHSA-mr82-8j83-vxmv). - jiter’s PyO3 update: [GHSA-36hh-v3qg-5jq4](https://github.com/advisories/GHSA-36hh-v3qg-5jq4), [GHSA-chgr-c6px-7xpp](https://github.com/advisories/GHSA-chgr-c6px-7xpp). - Azure Core and Requests: [GHSA-jm66-cg57-jjv5](https://github.com/advisories/GHSA-jm66-cg57-jjv5), [GHSA-gc5v-m9x4-r6x2](https://github.com/advisories/GHSA-gc5v-m9x4-r6x2). - PyJWT: [GHSA-993g-76c3-p5m4](https://github.com/advisories/GHSA-993g-76c3-p5m4), [GHSA-752w-5fwx-jx9f](https://github.com/advisories/GHSA-752w-5fwx-jx9f), [GHSA-w7vc-732c-9m39](https://github.com/advisories/GHSA-w7vc-732c-9m39), [GHSA-xgmm-8j9v-c9wx](https://github.com/advisories/GHSA-xgmm-8j9v-c9wx), [GHSA-jq35-7prp-9v3f](https://github.com/advisories/GHSA-jq35-7prp-9v3f), [GHSA-fhv5-28vv-h8m8](https://github.com/advisories/GHSA-fhv5-28vv-h8m8). - Cryptography: [GHSA-m2h6-j472-rp4c](https://github.com/advisories/GHSA-m2h6-j472-rp4c), [GHSA-jwv3-5hgf-82ww](https://github.com/advisories/GHSA-jwv3-5hgf-82ww), [GHSA-g6cj-pr64-35w5](https://github.com/advisories/GHSA-g6cj-pr64-35w5), [GHSA-537c-gmf6-5ccf](https://github.com/advisories/GHSA-537c-gmf6-5ccf), [GHSA-p423-j2cm-9vmq](https://github.com/advisories/GHSA-p423-j2cm-9vmq), [GHSA-m959-cc7f-wv43](https://github.com/advisories/GHSA-m959-cc7f-wv43), [GHSA-r6ph-v2qm-q3c2](https://github.com/advisories/GHSA-r6ph-v2qm-q3c2). - pytest and Pygments: [GHSA-6w46-j5rx-g56g](https://github.com/advisories/GHSA-6w46-j5rx-g56g), [GHSA-5239-wwwm-4pmq](https://github.com/advisories/GHSA-5239-wwwm-4pmq). </details>
A
Alex Chang committed
53aa4fc68b65f42456cafaaa5ff4b0d317184752
Parent: 370fcc6
Committed by GitHub <noreply@github.com>
on 8/19/2026, 4:22:10 PM